From b435e94d03e817700cb2a30717f451f1fe3c2ae8 Mon Sep 17 00:00:00 2001
From: Herbert Damker <52109189+hdamker@users.noreply.github.com>
Date: Thu, 1 Oct 2026 16:45:28 +0200
Subject: [PATCH] chore(deps): group Dependabot security updates for
 validation/

---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3b41512d..b17cb2b7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -28,6 +28,12 @@ updates:
       - "dependencies"
       - "javascript"
     open-pull-requests-limit: 5
+    # Security updates (incl. transitive dependencies) land as one lockfile PR
+    groups:
+      validation-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
 
   # pip (requirements.txt at repo root, consumed by shared-actions and workflows)
   - package-ecosystem: "pip"