From 4e2988018b82b8830d68ad3f227f047aec4cbeb7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Enrique=20Lo=CC=81pez=20Man=CC=83as?= Date: Fri, 6 Nov 2026 11:51:27 +0100 Subject: [PATCH] chore: group dependabot minor and patch updates --- .github/dependabot.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 239da4f..593b3ef 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,6 +21,19 @@ updates: open-pull-requests-limit: 10 commit-message: prefix: chore(deps) + # Let a release sit before adopting it, narrowing the window in which a + # compromised or immediately-yanked version can be pulled in. + cooldown: + default-days: 7 + semver-major-days: 14 + semver-minor-days: 7 + semver-patch-days: 3 + # Collapse routine minor/patch bumps into a single PR per ecosystem. + # Majors stay on their own so they still get individual review. + groups: + gradle-minor-and-patch: + patterns: ["*"] + update-types: ["minor", "patch"] - package-ecosystem: "github-actions" directory: "/" schedule: @@ -28,3 +41,11 @@ updates: open-pull-requests-limit: 10 commit-message: prefix: chore(deps) + # Let a release sit before adopting it, narrowing the window in which a + # compromised or immediately-yanked version can be pulled in. + cooldown: + default-days: 7 + groups: + github-actions-minor-and-patch: + patterns: ["*"] + update-types: ["minor", "patch"]