From 9210a5efeb28cebe61ffde8123d73b1220f55545 Mon Sep 17 00:00:00 2001 From: Diego Hurtado Date: Sun, 25 Oct 2026 21:01:16 -0600 Subject: [PATCH] ci: group Dependabot security updates for Python Only the github-actions ecosystem is declared today, so Dependabot opens one pull request per advisory per manifest for Python. thrift 0.13.0 to 0.24.0 arrived as #5611 and #5615, differing only in which of the two fork-process-model example directories they edit, and protobuf arrived the same way as #4884 and #4896. The uv and pip entries group security updates into a single pull request each. open-pull-requests-limit is 0 so that declaring the ecosystems does not switch on version updates, which Renovate already performs here. Security updates are governed by a separate fixed limit and are not affected by that setting. The cooldown has no effect on security updates. It is set because the dependabot-cooldown audit in zizmor reports any entry that omits it. --- .github/dependabot.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ace03dbb25d..87e15e64a8f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,3 +13,30 @@ updates: - "*" # Group all Actions updates into a single larger pull request schedule: interval: weekly + + - package-ecosystem: uv + directory: / + cooldown: + default-days: 7 + open-pull-requests-limit: 0 + groups: + python-security: + applies-to: security-updates + patterns: + - "*" + schedule: + interval: weekly + + - package-ecosystem: pip + directories: + - /** + cooldown: + default-days: 7 + open-pull-requests-limit: 0 + groups: + python-security: + applies-to: security-updates + patterns: + - "*" + schedule: + interval: weekly