fix(deps): corrigir alertas e agrupar atualizações do Dependabot

.github/dependabot.yml

@@ -1,12 +1,17 @@
 version: 2
 updates:
-  # target-branch routes version updates; security updates and alerts remain tied to the default branch.
+  # Version updates are grouped on develop to avoid exhausting the PR limit.
   - package-ecosystem: "npm"
     directory: "/frontend"
     schedule:
       interval: "weekly"
     target-branch: "develop"
     open-pull-requests-limit: 5
+    groups:
+      npm-version-updates:
+        applies-to: "version-updates"
+        patterns:
+          - "*"
     labels:
       - "DevSecOps"
       - "Frontend"
@@ -17,6 +22,41 @@ updates:
       interval: "weekly"
     target-branch: "develop"
     open-pull-requests-limit: 5
+    groups:
+      nuget-version-updates:
+        applies-to: "version-updates"
+        patterns:
+          - "*"
+    labels:
+      - "DevSecOps"
+      - "Backend"
+
+  # Security updates target the default branch. A dedicated entry is required
+  # because options from entries with target-branch do not apply to them.
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    groups:
+      npm-security-updates:
+        applies-to: "security-updates"
+        patterns:
+          - "*"
+    labels:
+      - "DevSecOps"
+      - "Frontend"
+
+  - package-ecosystem: "nuget"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    groups:
+      nuget-security-updates:
+        applies-to: "security-updates"
+        patterns:
+          - "*"
     labels:
       - "DevSecOps"
       - "Backend"

.github/scripts/tests/test_dependabot_configuration.py

@@ -0,0 +1,39 @@
+import re
+import unittest
+from pathlib import Path
+
+
+CONFIG = Path(__file__).resolve().parents[2] / "dependabot.yml"
+
+
+class DependabotConfigurationTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.config = CONFIG.read_text(encoding="utf-8")
+
+    def test_groups_version_updates_for_develop(self) -> None:
+        self.assertEqual(2, self.config.count('target-branch: "develop"'))
+        self.assertEqual(2, self.config.count('applies-to: "version-updates"'))
+        self.assertIn("npm-version-updates:", self.config)
+        self.assertIn("nuget-version-updates:", self.config)
+
+    def test_groups_security_updates_for_default_branch(self) -> None:
+        self.assertEqual(2, self.config.count('applies-to: "security-updates"'))
+        self.assertIn("npm-security-updates:", self.config)
+        self.assertIn("nuget-security-updates:", self.config)
+
+        security_entries = re.findall(
+            r'- package-ecosystem: "(?:npm|nuget)"(?:(?!- package-ecosystem:).)*?'
+            r'applies-to: "security-updates"(?:(?!- package-ecosystem:).)*',
+            self.config,
+            flags=re.DOTALL,
+        )
+        self.assertEqual(2, len(security_entries))
+        for entry in security_entries:
+            self.assertNotIn("target-branch:", entry)
+            self.assertIn("open-pull-requests-limit: 0", entry)
+            self.assertRegex(entry, r'patterns:\s+\- "\*"')
+
+
+if __name__ == "__main__":
+    unittest.main()