From 97990312c7c35078c0fe68fef232842c0c9f2fd4 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 9 Sep 2026 00:09:10 +0100
Subject: [PATCH] chore(dependabot): cap open pull requests per update block

Adds `open-pull-requests-limit` to Dependabot update blocks that had no
cap, following the estate per-ecosystem cap doctrine (task #37).
No other line in the file is touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk
---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 003c0dc..b6e2125 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,6 +13,7 @@ updates:
       actions:
         patterns:
           - "*"
+    open-pull-requests-limit: 2
 
   # Rust/Cargo
   #
@@ -37,18 +38,21 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
 
   # Node.js/npm
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
 
   # Python/pip
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
 
   # NOTE: Guix is banned estate-wide — Guix is the sole package manager.
   # Do not add a `guix` ecosystem here. Guix has no Dependabot ecosystem;