From f70417783678dd780eb02fd9ba35b59fdba0ff65 Mon Sep 17 00:00:00 2001
From: rebaserHEAD <38984539+rebaserHEAD@users.noreply.github.com>
Date: Tue, 28 Jul 2026 15:04:07 -0400
Subject: [PATCH] fix: tame dependabot to minor+patch, one grouped PR per lane

The first run opened seven PRs at once: the npm groups worked, but
github-actions had no group (five individual PRs), and the groups
happily proposed React 18->19, js-yaml 4->5, TypeScript 5.9->7 and
Vite 6->8. Those are migrations with real blast radius (js-yaml majors
touch the round-trip contract), not weekly maintenance.

Now: majors are ignored entirely across npm (upgraded deliberately,
parity sweep included), weekly PRs carry minor+patch grouped per lane,
and actions consolidate into a single grouped PR.
---
 .github/dependabot.yml | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ca3885d..cf08fd1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,9 @@
-# Weekly dependency PRs. Electron matters most here: it ships a Chromium,
-# so a stale Electron is a stale browser. Grouped so the noise stays low:
-# one PR for dev tooling, one for runtime deps, actions separately.
+# Weekly dependency PRs, tuned for quiet: one grouped PR per ecosystem lane,
+# minor+patch only. Majors never auto-PR — React, Vite, TypeScript, js-yaml
+# and friends are migrations with real blast radius (js-yaml majors touch the
+# round-trip contract), so they get done deliberately, parity sweep included.
+# Electron still matters most here: it ships a Chromium, so a stale Electron
+# is a stale browser; minors/patches arrive weekly via the dev-tooling group.
 version: 2
 updates:
   - package-ecosystem: npm
@@ -10,11 +13,20 @@ updates:
     groups:
       dev-tooling:
         dependency-type: development
+        update-types: [minor, patch]
       runtime:
         dependency-type: production
-    open-pull-requests-limit: 5
+        update-types: [minor, patch]
+    ignore:
+      - dependency-name: '*'
+        update-types: [version-update:semver-major]
+    open-pull-requests-limit: 3
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+    groups:
+      actions:
+        patterns: ['*']
+    open-pull-requests-limit: 2