From ea7191df856dbf50520960bd7b03177e8a4bf6f1 Mon Sep 17 00:00:00 2001 From: Artur Koniec Date: Fri, 14 Aug 2026 19:19:39 +0200 Subject: [PATCH] chore(deps): one dependabot pull request per ecosystem The nuget group was restricted to update-types [minor, patch], which meant a major matched no group at all and got a pull request to itself -- #511 NSubstitute, #510 Npgsql+Serilog, #234, #233. So a normal week produced the three grouped PRs plus one per major, and each merge forced a rebase of the rest because the main ruleset requires branches to be up to date. Dropping the update-types filter makes the group catch everything, majors included. Three PRs a week is the floor -- Dependabot raises them per ecosystem and cannot combine nuget, github-actions and docker into one -- and this reaches it. Deliberately not changed: security updates stay ungrouped, so a CVE fix arrives as its own immediate PR instead of waiting behind a broken major in a batch of thirty. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01AxWv8yHP7QAGFuFt2qS7q9 --- .github/dependabot.yml | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 57d2cdae..e6dd34d9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,15 @@ # Dependabot — automated dependency freshness (audit #0001 / H1). # Keeps the auth server and the four shipped images on patched dependencies, and surfaces newer -# action versions to pin against (the SHA-pinning follow-up, H6). Grouped to keep PR noise low. +# action versions to pin against (the SHA-pinning follow-up, H6). +# +# Target shape: exactly ONE pull request per ecosystem per week -- nuget, github-actions, docker. +# Three is the floor, not a preference: Dependabot raises pull requests per ecosystem and cannot +# combine across them. Every group below therefore matches "*" with no `update-types` filter, so +# nothing can fall outside a group and earn a pull request of its own. +# +# Security updates are deliberately NOT grouped (that needs `applies-to: security-updates`). They +# should keep arriving as their own immediate pull requests -- a CVE fix must never sit behind a +# broken major in a batch of thirty. version: 2 updates: @@ -11,9 +20,16 @@ updates: interval: "weekly" open-pull-requests-limit: 10 groups: - nuget-minor-patch: + # ONE pull request for every nuget update, majors included. Omitting `update-types` is what + # does it: with the old ["minor","patch"] restriction a major matched no group at all and got + # its own PR (#511 NSubstitute, #510 Npgsql+Serilog, #234, #233), so a quiet week still + # produced four or five. Dependabot cannot merge across ecosystems, so three PRs a week -- + # nuget, github-actions, docker -- is the floor, and this brings us to it. + # Trade-off, accepted deliberately: one breaking major now blocks the whole batch and there is + # no way to merge the good half. The fix is an `ignore` entry for the offender (see below for + # the working example), after which Dependabot rebuilds the PR without it. + nuget: patterns: ["*"] - update-types: ["minor", "patch"] ignore: # Microsoft.OpenApi 3.x cannot build on ASP.NET Core 10. Microsoft.AspNetCore.OpenApi 10.0.9 # (the whole 10.x line) depends on Microsoft.OpenApi 2.0.0, and its bundled XmlCommentGenerator