chore: ignore Dependabot patch releases

[senamakel]

Ignore semver patch updates for every configured ecosystem. Minor and major updates remain eligible, and security updates are unaffected.

[coderabbitai]

Warning

Review paused — included plan limit reached

Keep your review moving with free on-demand reviews.

• Run this review for free

On-demand reviews are free for one more day.

Promotion and pricing details

On-demand reviews are free for one more day. After that, they cost $0.25 per reviewed file.

Review limit details

Or wait 13 seconds for your next included review.

Check out review usage here.

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: eade2e58-a2fd-4a55-9bc9-a1e5ea81aea6

📥 Commits

Reviewing files that changed from the base of the PR and between 24d3e92 and 2a0a946.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T17:31:14.914407Z	2a0a946	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2a0a946106

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve patch-level security updates

When an advisory is fixed by a patch release, Dependabot security updates honor ignore rules, so this wildcard suppresses the remediation PR rather than only routine version-update noise; the identical GitHub Actions rule has the same problem. This contradicts the commit's stated expectation that security updates remain unaffected and can leave a vulnerable locked dependency without an automated fix, so routine patch PRs need to be filtered by a mechanism that does not globally ignore patch updates.

Useful? React with 👍 / 👎.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 3 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: medium
Reviewed head: 2a0a946106f0
Updated: 1789839413 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	3
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

• medium · critique · Allow grouped Cargo patch updates — This wildcard ignore takes precedence over the `cargo-minor-and-patch` group below, so the group can receive minor updates but never patch updates. For example, a dependency update (\.github/dependabot\.yml:7)
• medium · security · Do not suppress patch updates for every dependency — The wildcard ignore rule disables routine patch updates for every Cargo dependency in this update group, including patches that may contain security fixes or important bug fixes. D (\.github/dependabot\.yml:7)
• medium · security · Keep patch updates enabled for GitHub Actions — This rule also applies to the GitHub Actions update group, preventing automatic patch updates for every action. That can leave workflow actions on versions with known or subsequent (\.github/dependabot\.yml:7)

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change adds wildcard patch ignores. In the Cargo configuration this disables the existing grouped patch-update policy, so routine bug and security fixes such as patch releases will no longer be proposed; it should not merge as written. (1 observation(s) grouped into shared inline comments) _The code index is behind this pull request (indexed at `d13a5b33645a`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/dependabot\.yml — Allow grouped Cargo patch updates

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change suppresses all routine patch-level dependency and GitHub Actions updates. This creates a broad maintenance and security-update gap, so it should not merge unchanged. (1 observation(s) grouped into shared inline comments) _The code index is behind this pull request (indexed at `d13a5b33645a`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/dependabot\.yml — Do not suppress patch updates for every dependency
• Evidence: \.github/dependabot\.yml — Keep patch updates enabled for GitHub Actions

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds an ignore rule for semver-patch updates to both the `cargo` and `github-actions` Dependabot configurations, as described. The change is correct, matches its description, and introduces no defects. _The code index is behind this pull request (indexed at `d13a5b33645a`), so retrieved context may be out of date._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.003023
• Tokens: 56255 input · 6119 output · 7876 cached · 34 embedding

Head	State	Pass summary
2a0a946106f0	ready for maintainer review	3 active finding(s), 0 resolved finding(s) (at 1789839413)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0030 · 56,255 in / 6,119 out · 7,876 cached (14%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 34 embedded
critique:    $0.0018 · 32,751 in / 2,261 out · 5,072 cached (15%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0009 · 15,165 in / 846 out   · 1,780 cached (12%) · gpt-5.6-luna
description: $0.0001 · 6,758 in  / 687 out   · 1,024 cached (15%) · deepseek-v4-flash

[tinysweeper]

Keep patch updates enabled for GitHub Actions

This rule also applies to the GitHub Actions update group, preventing automatic patch updates for every action. That can leave workflow actions on versions with known or subsequently fixed vulnerabilities and delays security maintenance across CI. Remove the wildcard suppression or narrowly exclude only actions with a demonstrated incompatibility.

---

Additional critique observation

Allow grouped Cargo patch updates

[RULE] dependency-update-scope

This wildcard ignore takes precedence over the cargo-minor-and-patch group below, so the group can receive minor updates but never patch updates. For example, a dependency update from 0.13.1 to 0.13.2 will be suppressed entirely, including fixes delivered in patch releases, contradicting the existing group configuration and the repository's stated Dependabot practice. Remove this ignore entry or narrow it to dependencies that are intentionally excluded.

Suggested change for this observation (reference only)

---

Additional security observation

Do not suppress patch updates for every dependency

[RULE] dependency-update-suppression

The wildcard ignore rule disables routine patch updates for every Cargo dependency in this update group, including patches that may contain security fixes or important bug fixes. Dependabot's separate security-update flow can cover known advisories, but fixes that are not yet recognized as advisories—or updates needed to keep the dependency graph secure—will no longer be proposed automatically. Remove the wildcard suppression or scope it to specific dependencies with a documented compatibility reason.

[RULE] dependency-update-suppression ·