chore: ignore Dependabot patch releases

[senamakel]

Ignore semver patch updates for every configured ecosystem. Minor and major updates remain eligible, and security updates are unaffected.

Summary by CodeRabbit

• Chores
  • Automated dependency updates no longer include patch-level version changes for Cargo packages and GitHub Actions.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T17:31:17.713419Z	3b0f29d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b986732d-fc64-4825-9575-8926239b301c

📥 Commits

Reviewing files that changed from the base of the PR and between a5d04a7 and 3b0f29d.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependabot now ignores patch version updates for all Cargo and GitHub Actions dependencies.

Changes

Dependabot update filtering

Layer / File(s)	Summary
Patch update suppression .github/dependabot.yml	The Cargo and GitHub Actions update blocks ignore version-update:semver-patch updates for all dependencies.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuring Dependabot to ignore patch releases.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{A rabbit checks the update gate
Patch hops pause and wait
Cargo rests beneath the moon
Actions follow the tune
Dependabot keeps the garden neat}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 4 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: medium
Reviewed head: 3b0f29d195c1
Updated: 1789839396 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	4
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

• medium · critique · Do not ignore every patch update — This wildcard suppresses patch updates for every dependency in the group, including patch releases containing bug fixes or non-security corrections. The repository's weekly Dependa (\.github/dependabot\.yml:7)
• medium · critique · Do not ignore patch updates for GitHub Actions — The same wildcard is applied to the GitHub Actions update group, so patch releases of actions used by CI are never proposed. That can leave workflow actions on outdated patch versi (\.github/dependabot\.yml:7)
• medium · security · Do not suppress patch updates for every dependency — This wildcard ignore applies to every dependency in the Cargo and GitHub Actions update groups, preventing normal patch-level updates from being proposed. Patch releases commonly c (\.github/dependabot\.yml:7)
• medium · security · Continue proposing patch updates for GitHub Actions — The same blanket suppression is added to the GitHub Actions update group, so patch updates to CI actions such as checkout, toolchain, caching, and supply-chain checks will no longe (\.github/dependabot\.yml:7)

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change suppresses all semver-patch Dependabot updates for both Cargo dependencies and GitHub Actions. This is not safe to merge because ordinary patch releases can contain important bug fixes, and the configuration removes their automated update path. (1 observation(s) grouped into shared inline comments) _The code index is behind this pull request (indexed at `05dd8482b0fb`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/dependabot\.yml — Do not ignore every patch update
• Evidence: \.github/dependabot\.yml — Do not ignore patch updates for GitHub Actions

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change suppresses all weekly semver-patch Dependabot update pull requests for both ecosystems. This delays routine dependency fixes and should not be merged without narrowly scoping the suppression or retaining patch updates. (2 observation(s) grouped into shared inline comments) _The code index is behind this pull request (indexed at `05dd8482b0fb`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/dependabot\.yml — Do not suppress patch updates for every dependency
• Evidence: \.github/dependabot\.yml — Continue proposing patch updates for GitHub Actions

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change adds Dependabot ignore rules to suppress patch version updates for both Cargo and GitHub Actions ecosystems. The configuration is syntactically correct, matches the stated intent, and introduces no defects or violations of repository rules. _The code index is behind this pull request (indexed at `05dd8482b0fb`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.002003
• Tokens: 38193 input · 3724 output · 5340 cached · 34 embedding

Head	State	Pass summary
3b0f29d195c1	ready for maintainer review	4 active finding(s), 0 resolved finding(s) (at 1789839396)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0020 · 38,193 in / 3,724 out · 5,340 cached (14%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 34 embedded
critique:    $0.0009 · 15,880 in / 949 out   · 2,536 cached (16%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0009 · 14,460 in / 868 out   · 1,780 cached (12%) · gpt-5.6-luna
description: $0.0001 · 6,237 in  / 694 out   · 1,024 cached (16%) · deepseek-v4-flash

[tinysweeper]

Do not ignore patch updates for GitHub Actions

The same wildcard is applied to the GitHub Actions update group, so patch releases of actions used by CI are never proposed. That can leave workflow actions on outdated patch versions despite the repository's stated weekly Dependabot maintenance and supply-chain checks. Remove this blanket ignore or enumerate only actions whose patch updates have been deliberately excluded.

---

Additional critique observation

Do not ignore every patch update

[RULE] ignore-all-patch-updates

This wildcard suppresses patch updates for every dependency in the group, including patch releases containing bug fixes or non-security corrections. The repository's weekly Dependabot configuration will therefore leave dependencies and actions stale until a minor/major release or a manual update occurs. Restrict the ignore rule to explicitly reviewed dependencies, or remove it so patch updates continue to be proposed.

---

Additional security observation

Do not suppress patch updates for every dependency

[RULE] dependency-update-suppression

This wildcard ignore applies to every dependency in the Cargo and GitHub Actions update groups, preventing normal patch-level updates from being proposed. Patch releases commonly contain bug fixes and security fixes that may not be surfaced as Dependabot security updates, so this can leave the repository running vulnerable or broken dependency versions indefinitely. Remove the blanket ignore or scope it to specific dependencies with a documented compatibility reason.

---

Additional security observation

Continue proposing patch updates for GitHub Actions

[RULE] dependency-update-suppression

The same blanket suppression is added to the GitHub Actions update group, so patch updates to CI actions such as checkout, toolchain, caching, and supply-chain checks will no longer be proposed. This delays action security and correctness fixes across the repository's CI boundary. Keep patch updates enabled or restrict the ignore rule to an explicitly reviewed action.

[RULE] ignore-all-patch-updates ·