chore: ignore Dependabot patch releases

[senamakel]

Ignore semver patch updates for every configured ecosystem. Minor and major updates remain eligible, and security updates are unaffected.

Summary by CodeRabbit

• Chores
  • Configured automated dependency updates to skip patch-level updates for Cargo and GitHub Actions dependencies.
  • Continued limiting automated dependency update pull requests to five per ecosystem.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T17:30:17.533664Z	c216573	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8033758a-9e73-4819-8ac4-edf1c1465ab6

📥 Commits

Reviewing files that changed from the base of the PR and between 5ea1faa and c216573.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependabot now ignores patch-level updates for all Cargo and GitHub Actions dependencies. The existing pull request limit remains five for each ecosystem.

Changes

Dependabot update filtering

Layer / File(s)	Summary
Patch update rules .github/dependabot.yml	The Cargo and GitHub Actions update blocks ignore version-update:semver-patch updates for all dependencies. Both blocks retain open-pull-requests-limit: 5.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuring Dependabot to ignore patch-level releases.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{A rabbit checks the update trail
Patch-sized hops now leave no mail
Cargo rests beneath the moon
Actions wait for larger tune
Five bright requests remain in line
The config settles, neat and fine}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 1 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: medium
Reviewed head: c21657397573
Updated: 1789839188 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	1
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

• medium · security · Do not ignore all patch updates — This wildcard ignore suppresses every patch-level version update for the Cargo ecosystem, and the same configuration is added for GitHub Actions below. Patch releases commonly cont (\.github/dependabot\.yml:7)

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The Dependabot configuration correctly suppresses semver-patch update pull requests for both Cargo dependencies and GitHub Actions. The change is safe to merge. _The code index is behind this pull request (indexed at `27ac3f43ec14`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change broadly suppresses Dependabot patch-level updates for both package managers, creating a security-maintenance gap. It should not be merged without preserving patch update coverage. _The code index is behind this pull request (indexed at `27ac3f43ec14`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/dependabot\.yml — Do not ignore all patch updates

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Ignore Dependabot patch updates for Cargo and GitHub Actions dependencies. Minor and major updates remain eligible. The configuration is valid and matches the pull request's description. _The code index is behind this pull request (indexed at `27ac3f43ec14`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.002994
• Tokens: 59222 input · 4423 output · 6852 cached · 34 embedding

Head	State	Pass summary
c21657397573	ready for maintainer review	1 active finding(s), 0 resolved finding(s) (at 1789839188)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0030 · 59,222 in / 4,423 out · 6,852 cached (12%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 34 embedded
critique:    $0.0018 · 34,347 in / 856 out   · 4,048 cached (12%) · gpt-5.6-luna
security:    $0.0010 · 16,803 in / 709 out   · 1,780 cached (11%) · gpt-5.6-luna
description: $0.0001 · 6,641 in  / 398 out   · 1,024 cached (15%) · deepseek-v4-flash

[tinysweeper]

Do not ignore all patch updates

This wildcard ignore suppresses every patch-level version update for the Cargo ecosystem, and the same configuration is added for GitHub Actions below. Patch releases commonly contain security fixes, so this prevents Dependabot from opening updates that keep dependencies current and increases the window in which known vulnerabilities can remain deployed. Remove the blanket patch-version ignore or restrict it to explicitly justified dependencies.

[RULE] dependency-update-policy ·