Group Dependabot security updates into a single pull request

[j0ntz]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

Description

Collapses Dependabot's security update PRs into a single grouped PR. We currently have 27 open, going back to March 2023.

Why it got this bad: this repo has no .github/dependabot.yml at all, so every Dependabot PR here is an alert-driven security update, and security updates are explicitly exempt from open-pull-requests-limit. There was no setting to turn down without adding a config file first.

What the config does:

• groups.all-security-updates with applies-to: security-updates and patterns: ['*'] puts every security fix in one PR. The applies-to key is load-bearing: without it, grouping defaults to version updates only and would change nothing here.
• open-pull-requests-limit: 0 keeps version updates off, so adding this file does not trade 27 security PRs for a larger firehose of routine version bumps. GitHub documents this value for the security-updates-only case.
• schedule.interval is required syntax but inert. Security updates fire on new advisories, not on an interval, and there are no version updates left for it to govern.

What to expect after merge:

Per GitHub's docs, "When grouped security updates are first enabled, Dependabot will immediately try to create grouped pull requests. You may notice Dependabot closing old pull requests and opening new ones." So this should not wait for a scheduled tick.

Dependabot closes an old PR once the new grouped PR covers the same dependency. Anything it cannot fit into the group, most likely the transitive bumps blocked by a pinned parent, will stay open and need closing by hand. Use a plain close for those, not @dependabot close, which suppresses recreation and would drop the dependency from future grouped PRs.

Steady state after this is at most one open Dependabot PR. New advisories fold into that PR while it is open rather than opening another, so it is worth merging promptly instead of letting it sit and rebase underneath us.

Reference: Dependabot options reference.

---

Note

Low Risk
CI/dependency automation only; no application runtime, auth, or data-path changes.

Overview
Adds .github/dependabot.yml so Dependabot no longer opens one security-fix PR per advisory. The repo previously had no Dependabot config, so alert-driven security updates were exempt from any PR cap and had piled up (e.g. many open PRs).

groups.all-security-updates uses applies-to: security-updates and patterns: ['*'] to fold all npm security bumps at / into a single grouped PR; without applies-to, grouping would only apply to version updates and would not change behavior here.

open-pull-requests-limit: 0 disables routine version-update PRs while security updates still flow. schedule.interval: weekly is required schema only; security work is advisory-driven, not interval-driven.

After merge, Dependabot may close older security PRs and open one grouped PR; steady state should be at most one open Dependabot PR with new advisories folded into it while it stays open.

^{Reviewed by Cursor Bugbot for commit fe5c19b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.