From 56a4b99c567007040a94b5e5bd72fbebd5129bc4 Mon Sep 17 00:00:00 2001 From: Tom Riglar Date: Mon, 26 Oct 2026 14:14:43 +0000 Subject: [PATCH] ci: group Dependabot security-update PRs Dependabot groups apply to scheduled version updates unless they say `applies-to: security-updates`, so every advisory opened its own PR. Add a `security` group to each npm entry, so a burst of advisories arrives as one PR. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 70a331d..51afc64 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -20,6 +20,10 @@ updates: update-types: - minor - patch + security: + applies-to: security-updates + patterns: + - "*" ignore: # ncc (0.45, the latest) compiles through TypeScript's JS compiler API, # which TypeScript 7, the native Go port, does not ship: `pnpm build`