From 8e6c7c0b71dc370fc554e47aaba8521b15308919 Mon Sep 17 00:00:00 2001 From: shenxianpeng Date: Fri, 11 Sep 2026 23:50:38 +0300 Subject: [PATCH] chore(deps): fix Dependabot groups so dev/docs deps update in one PR The `dev` group never applied to version updates: GitHub kept the `applies-to: security-updates` value set in #345 after #353 removed the key, so weekly jobs only carried the `org` group and every dev/docs bump became an individual PR. - set `applies-to: version-updates` explicitly on `org` and `dev` - drop `update-types` so patch bumps join the group too - match `org` packages exactly instead of `*` + exclude-patterns (`markdown-gfm-admonition` was landing in `org`) - add a `security` group so security fixes stay grouped --- .github/dependabot.yml | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6e349650..b7264f2a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,22 +21,21 @@ updates: open-pull-requests-limit: 10 groups: org: - # updates about org-maintained packages + # org-maintained packages (the "action" dependency group) + applies-to: version-updates patterns: - - "*" - exclude-patterns: - - "mypy*" - - "pre-commit*" - - "ruff*" - - "mkdocs*" - - "pyyaml*" + - "clang-tools" + - "cpp-linter" dev: - # updates about everything else (dev and docs) + # everything else: dev tooling + docs (major/minor/patch all in one PR) + applies-to: version-updates patterns: - "*" exclude-patterns: - - "clang-tools*" - - "cpp-linter*" - update-types: - - major - - minor + - "clang-tools" + - "cpp-linter" + security: + # keep security fixes grouped too (previously happened only by accident) + applies-to: security-updates + patterns: + - "*"