From 0784162fbcaac76408188c43867298a0c557ce78 Mon Sep 17 00:00:00 2001
From: Moritz Mazetti <moritz@matchory.com>
Date: Tue, 3 Nov 2026 11:10:45 +0100
Subject: [PATCH] chore(deps): align Dependabot config with the org supply
 chain baseline

Minor and patch updates grouped per ecosystem, majors one PR each,
security updates grouped, 3-day cooldown.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018rbNSgXszHsJUz325prezd
---
 .github/dependabot.yml | 67 ++++++++++++++++++++++++------------------
 1 file changed, 38 insertions(+), 29 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index eeef6af..98973f0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,43 +1,52 @@
-# Grouped per ecosystem, with a five-day cooldown as a supply-chain control: most malicious releases
-# are detected and yanked within hours. Security updates are advisory-driven and ignore the cooldown.
-
+# Follows the matchory supply chain baseline:
+# https://github.com/matchory/.github/blob/main/supply-chain/STANDARD.md
+#
+#   - cooldown: a release must be 3 days old before Dependabot proposes it
+#     (does not delay security updates)
+#   - minor + patch updates arrive as ONE grouped PR per ecosystem
+#   - major updates are never grouped: one PR per dependency, reviewed on its own
+#   - security updates get their own group per ecosystem
 version: 2
 
-multi-ecosystem-groups:
-  app:
-    schedule:
-      interval: weekly
-  github-actions:
-    schedule:
-      interval: weekly
-
 updates:
-  - package-ecosystem: uv
-    multi-ecosystem-group: app
+  - package-ecosystem: github-actions
     directory: /
-    patterns:
-      - '*'
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Europe/Berlin
     cooldown:
-      default-days: 5
-    labels:
-      - dependencies
+      default-days: 3
+      semver-major-days: 3
+      semver-minor-days: 3
+      semver-patch-days: 3
     groups:
+      minor-and-patch:
+        applies-to: version-updates
+        update-types: [minor, patch]
       security:
         applies-to: security-updates
-        patterns:
-          - '*'
+        patterns: ["*"]
+    labels: [dependencies, github-actions]
 
-  - package-ecosystem: github-actions
-    multi-ecosystem-group: github-actions
+  - package-ecosystem: uv
     directory: /
-    patterns:
-      - '*'
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Europe/Berlin
     cooldown:
-      default-days: 5
-    labels:
-      - dependencies
+      default-days: 3
+      semver-major-days: 3
+      semver-minor-days: 3
+      semver-patch-days: 3
     groups:
+      minor-and-patch:
+        applies-to: version-updates
+        update-types: [minor, patch]
       security:
         applies-to: security-updates
-        patterns:
-          - '*'
+        patterns: ["*"]
+    labels: [dependencies, python]