chore: ignore Dependabot patch releases

[senamakel]

Ignore semver patch updates for every configured ecosystem. Minor and major updates remain eligible, and security updates are unaffected.

Summary by CodeRabbit

• Chores
  • Dependabot will no longer create pull requests for patch-version dependency updates.
  • Minor and major dependency updates remain eligible for automated pull requests.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T17:30:41.158345Z	73efc2b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: d59ebaed-a306-4817-98c4-d8a0489947a9

📥 Commits

Reviewing files that changed from the base of the PR and between 258ad67 and 73efc2b.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Dependabot configuration now excludes patch-version updates for Cargo dependencies and GitHub Actions. Minor and major updates remain eligible.

Changes

Dependabot update policy

Layer / File(s)	Summary
Patch update exclusions .github/dependabot.yml	Cargo and GitHub Actions ignore patch-version updates for all dependencies. Existing minor and major update behavior remains unchanged. Cargo patch updates are also excluded from the existing group.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: Dependabot will ignore semver patch updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{A rabbit checks the update trail
Patch hops stop before the rail
Minor and major still pass through
Cargo follows the rulebook too
Actions rest in silence, neat
The config keeps its rhythm sweet}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: low
Reviewed head: 73efc2b50b23
Updated: 1789840546 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change suppresses all Dependabot semver-patch updates for both Cargo and GitHub Actions, which conflicts with the existing Cargo group description that says minor and patch updates are grouped. This is safe only if disabling patch updates is intentional; otherwise the configuration should be aligned before merging. _The code index for this repository is cold, so this review saw the diff alone._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The Dependabot configuration safely limits routine patch update noise while retaining minor and major update coverage. No security issue is introduced by this change. _The code index for this repository is cold, so this review saw the diff alone._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change adds Dependabot ignore rules for patch updates across all configured ecosystems, reducing noise while preserving minor and major updates and leaving security updates unaffected. The diff is correct, matches the description, and introduces no problems. _The code index for this repository is cold, so this review saw the diff alone._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: flash, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.001975
• Tokens: 43564 input · 5723 output · 14136 cached · 0 embedding

Head	State	Pass summary
73efc2b50b23	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 1789840546)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0020 · 43,564 in / 5,723 out · 14,136 cached (32%) · flash, gpt-5.6-luna, deepseek-v4-flash
critique:    $0.0009 · 16,470 in / 1,371 out · 5,072 cached (31%)  · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0007 · 14,364 in / 493 out   · 3,560 cached (25%)  · gpt-5.6-luna
description: $0.0001 · 6,625 in  / 445 out   · 1,024 cached (15%)  · deepseek-v4-flash