From 155e1b1ca641906c1f8f7f251c38c5e452d6b41b Mon Sep 17 00:00:00 2001 From: Omar Shahine <10343873+omarshahine@users.noreply.github.com> Date: Tue, 1 Sep 2026 00:34:42 +0000 Subject: [PATCH] fix(deps): group Dependabot security updates per directory Security updates are not grouped by default, so a repo with several advisories in one lockfile gets several PRs that all edit that lockfile. Merging any one invalidates the rest; `@dependabot recreate` rebuilds them; the next merge breaks them again. Lobster, findmy-cli and openclaw-parcel were stuck in exactly that loop -- recreated, green, then conflicted again on the next merge, twice over. `applies-to: security-updates` collapses them into one PR per directory. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01VDD6P9ft7DNNbrXpNWvCsk --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 648ec53..88ef78e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -19,6 +19,14 @@ updates: schedule: interval: monthly groups: + # ⚠️ Security updates are NOT grouped by default, so a repo with several + # advisories in one lockfile gets several PRs that all edit it. Merging + # any one invalidates the rest, `@dependabot recreate` rebuilds them, and + # the next merge breaks them again. This repo was stuck in that loop. + security: + applies-to: security-updates + patterns: + - "*" production: dependency-type: production development: