chore: ignore Dependabot patch releases

[senamakel]

Ignore semver patch updates for every configured ecosystem. Minor and major updates remain eligible, and security updates are unaffected.

Summary by CodeRabbit

• Chores
  • Dependabot will now skip semver patch updates for Cargo dependencies and GitHub Actions, while continuing to process other update types on the existing schedules.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T17:31:01.071749Z	b38dfc8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8dd2ff75-1670-49d7-8c72-57b893dac673

📥 Commits

Reviewing files that changed from the base of the PR and between ea6677c and b38dfc8.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependabot now ignores semver patch updates for Cargo dependencies and GitHub Actions. Existing schedules, limits, and other update types remain unchanged.

Changes

Dependabot update filters

Layer / File(s)	Summary
Patch update exclusions .github/dependabot.yml	The Cargo and GitHub Actions rules ignore dependencies whose update type is version-update:semver-patch.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuring Dependabot to ignore patch releases.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{A rabbit checks the update queue
Patch hops wait for skies more blue
Cargo rests beside the Actions gate
Other updates keep their appointed date
The schedule stays calm and neat}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b38dfc84b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve Dependabot security updates

When a Cargo or GitHub Actions dependency has a vulnerability fix, these wildcard rules also suppress its security-update PR: for security updates, Dependabot ignores the update-types attribute and still applies dependency-name, so "*" excludes every dependency. Use a mechanism that disables routine patch version PRs without applying a wildcard ignore rule to security updates.

Useful? React with 👍 / 👎.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: low
Reviewed head: b38dfc84b707
Updated: 1789839499 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The configuration suppresses all semver-patch updates for Cargo and GitHub Actions. This conflicts with the Cargo grouping and its comment, so the change should be aligned with the intended update policy before merging. _The code index is behind this pull request (indexed at `7dd00d74e96b`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The Dependabot configuration now suppresses routine semver-patch update pull requests for both configured ecosystems. Security updates remain separately managed, and this change introduces no actionable security defect. _The code index is behind this pull request (indexed at `7dd00d74e96b`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds Dependabot ignore rules for semver-patch updates on both Cargo and GitHub Actions, reducing noise while keeping minor/major and security updates. The change is correct and safe to merge. _The code index is behind this pull request (indexed at `7dd00d74e96b`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.002825
• Tokens: 55057 input · 5441 output · 7876 cached · 34 embedding

Head	State	Pass summary
b38dfc84b707	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 1789839499)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0028 · 55,057 in / 5,441 out · 7,876 cached (14%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 34 embedded
critique:    $0.0018 · 32,131 in / 2,944 out · 5,072 cached (16%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0008 · 14,865 in / 447 out   · 1,780 cached (12%) · gpt-5.6-luna
description: $0.0001 · 6,597 in  / 597 out   · 1,024 cached (16%) · deepseek-v4-flash