ci(security): add Dependabot groups for batched alert processing#41
Conversation
Why:
Mon 2026-05-25 06:00 UTC Dependabot wave projected to ~50 individual
PRs across the 3 paybot repos. Solo-founder bandwidth cannot absorb.
Groups batch into ~12-15 PRs total.
What:
npm ecosystem: 5 groups
- npm-patch-prod / npm-minor-prod (version-updates, prod, split by risk)
- npm-dev-deps (version-updates, dev, batched freely)
- npm-security-patch / npm-security-minor (security-updates, split by severity)
uv ecosystem (packages/python): 4 groups
- uv-patch / uv-minor (version-updates)
- uv-security-patch / uv-security-minor
(uv lacks the dependency-type axis npm has, so groups split by
update-type alone; severity split preserved for security updates.)
Precedent: scanner-bundle PRs paybot-core #3 (6dc6f5aa), paybot-sdk #11
(2513676), paybot-mcp #1 (a6c211db) — same gate model.
Authority: full SINKRA chain per .claude/rules/automated-pr-merge-authority.md.
@qa lightweight (CI green + YAML validity + schema correct) then @devops merge.
DO NOT MERGE before @qa PASS.
Deadline: must merge before Mon 2026-05-25 06:00 UTC.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughUpdated ChangesDependabot Update Groups
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces grouping for Dependabot updates in the npm and Python (uv) ecosystems to batch patch and minor updates, aiming to reduce PR volume. Feedback indicates that the comments regarding security updates being split by severity are inaccurate as Dependabot only supports grouping by update type. Furthermore, the npm security groups should explicitly specify the production dependency type to ensure consistent isolation between production and development risk tiers.
| # Dev deps batched freely (no runtime exposure). Security updates split by | ||
| # severity so a critical CVE never gets bundled with a minor upgrade. |
There was a problem hiding this comment.
The comment states that security updates are split by severity, but the configuration actually filters by update-types (patch vs. minor). Dependabot groups do not natively support a severity filter. A critical vulnerability and a low-severity vulnerability will be bundled together if they both result in the same update type (e.g., both are patches). The current configuration effectively isolates major updates by not including them in any group.
# Dev deps batched freely (no runtime exposure). Security updates split by
# update-types to keep PR volume manageable while isolating major updates.| npm-security-patch: | ||
| applies-to: security-updates | ||
| update-types: ["patch"] | ||
| npm-security-minor: | ||
| applies-to: security-updates | ||
| update-types: ["minor"] |
There was a problem hiding this comment.
These security groups do not specify a dependency-type. Consequently, security updates for both production and development dependencies will be bundled together. This contradicts the goal stated on lines 34-35 to keep "risk-tiers separate" and ensure dev dependencies have "no runtime exposure". To maintain this isolation for security updates, consider adding dependency-type: "production" to these groups.
npm-security-patch:
applies-to: security-updates
update-types: ["patch"]
dependency-type: "production"
npm-security-minor:
applies-to: security-updates
update-types: ["minor"]
dependency-type: "production"| # split by update-types alone. Security updates split by severity to | ||
| # keep critical CVEs unbundled. |
There was a problem hiding this comment.
Similar to the npm section, the comment claims to split by severity, but the implementation uses update-types. Since Dependabot does not support severity-based grouping, this description is inaccurate. A critical CVE will still be bundled with other updates if it falls under the 'patch' or 'minor' update types.
# split by update-types alone. Security updates split by update-types to
# keep PR volume manageable while isolating major updates.![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
Why
Mon 2026-05-25 06:00 UTC Dependabot wave: ~50 individual PRs expected across the 3 paybot repos. Solo-founder bandwidth cannot absorb. Groups: block batches into ~12-15 PRs.
paybot-sdk currently shows 6 open vulnerabilities (3 high, 3 moderate) on default branch — all will surface as PRs Monday morning. Without grouping, that's 6 separate PRs from this repo alone, on top of weekly version-updates.
What
Adds groups: block per @devops 3-week absorption runbook (handoff-2026-05-22-paybot-gtm-multi-track.md):
npm ecosystem (5 groups):
npm-patch-prod— version-updates, patch, productionnpm-minor-prod— version-updates, minor, productionnpm-dev-deps— version-updates, development (all update-types)npm-security-patch— security-updates, patchnpm-security-minor— security-updates, minoruv ecosystem at /packages/python (4 groups):
uv-patch/uv-minor— version-updatesuv-security-patch/uv-security-minor— security-updatesuv lacks npm's
dependency-type: production|developmentaxis (uv uses pyprojectdependency-groups), so the uv block splits by update-type alone. Security severity split preserved.Authority
automated-pr-merge-authority.md: requires @qa lightweight (CI green + YAML validity + groups schema correct) + @devops merge.Deadline
Must merge before Mon 2026-05-25 06:00 UTC (Dependabot daily run).
YAML validation
Local
python -c "import yaml; yaml.safe_load(...)"passes. All 3 ecosystems parse cleanly; group keys verified.Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com
Summary by CodeRabbit