chore(deps): fix Dependabot groups so dev/docs deps update in one PR

[shenxianpeng]

Why

Dependabot keeps opening one PR per dev dependency (currently #474 for mypy and #478 for ruff) although dependabot.yml defines a dev group.

Root cause, taken from the Dependabot job logs (Insights → Dependency graph → Dependabot → uv.lock):

• Every weekly version-update job only carries the org group (Found 1 group(s)). The dev group is absent from the job definition.
• Security-update jobs do carry dev, with "applies-to": "security-updates".
• fix: update dependabot.yml to add applies-to #345 set applies-to: security-updates on dev; chore: group dependency updates with exclude-patterns #353 removed the key, but GitHub kept the old value while refreshing the other rules. org was a new group name in chore: group dependency updates with exclude-patterns #353, so it got the default.
• That is why every "bump the dev group" PR so far (chore(deps): bump the dev group across 1 directory with 4 updates #407, chore(deps): bump requests from 2.32.4 to 2.33.0 in the dev group across 1 directory #421, chore(deps): bump pip from 26.0 to 26.1 in the dev group across 1 directory #431, chore(deps): bump the dev group across 1 directory with 3 updates #447, chore(deps): bump pymdown-extensions from 10.21.3 to 11.0.1 in the dev group across 1 directory #468) came from a security advisory, and why even major/minor bumps of mypy (chore(deps-dev): bump mypy from 1.18.1 to 2.1.0 #435, chore(deps-dev): bump mypy from 2.1.0 to 2.3.0 #461) were opened individually.

Two smaller issues fixed on the way:

• update-types: [major, minor] would have excluded patch bumps from the group anyway. dependabot-core opens an individual PR for any level not listed, which is exactly the chore(deps-dev): bump mypy from 2.3.0 to 2.3.1 #474/chore(deps-dev): bump ruff from 0.16.2 to 0.16.6 #478 case.
• org used * plus exclude-patterns, so markdown-gfm-admonition was being assigned to the org group (visible in the logs).

What changed

• org: explicit applies-to: version-updates, exact patterns clang-tools and cpp-linter.
• dev: explicit applies-to: version-updates, no update-types, so major/minor/patch bumps of everything else land in one PR.
• New security group (applies-to: security-updates, *) so security fixes stay grouped. Until now that only happened by accident. Drop it if individual security PRs are preferred.

How to verify

Merging triggers a uv job right away. Its log should say Found 2 group(s) and Dependabot should open a single "bump the dev group with N updates" PR; #474 and #478 then get superseded.

Fallback: if the log still reports one group, rename dev. GitHub appears to key the stale value on the group name, so a new name starts clean.

Summary by CodeRabbit

• Chores
  • Updated automated dependency update grouping for clearer handling of development and tooling packages.
  • Added a dedicated group for security-related dependency updates.
  • Adjusted update scopes to distinguish version updates from security updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 081269ee-e6ff-413d-8318-6cbd35ffc59b

📥 Commits

Reviewing files that changed from the base of the PR and between 97585db and 8e6c7c0.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The Dependabot configuration separates version updates for organization packages and development packages. It also adds a group for security updates.

Changes

Dependabot grouping

Layer / File(s)	Summary
Update group configuration .github/dependabot.yml	The org group now targets clang-tools and cpp-linter. The dev group covers the remaining version updates. The new security group covers all security updates.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 8e6c7

This PR only adjusts Dependabot grouping behavior and is ready to merge with normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: updating Dependabot groups so development and documentation dependencies are grouped in one pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[shenxianpeng]

Hopefully this change could work as expected

[2bndy5]

🤞

Here's hoping those dependabot bugs were fixed...