From 3613e7ae6fcbcedd245decfb57aff5fcc7ca1794 Mon Sep 17 00:00:00 2001
From: Benjamin Demaille <benjamin.demaille@icloud.com>
Date: Sun, 23 Aug 2026 23:42:04 +0200
Subject: [PATCH 1/2] chore(ci): cover docs/ npm and Docker base images in
 dependabot, group updates

The config watched cargo and github-actions only, so the Astro Starlight site
in docs/ (pnpm) and the two Dockerfile base images were never updated.

Minor and patch bumps are now grouped into one PR per ecosystem per week;
major bumps stay individual because they need review. Adds per-ecosystem
commit-message prefixes and open-pull-requests-limit to cut PR churn.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml | 51 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 50 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a1cd7d25..f0a0a824 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,11 +1,60 @@
 version: 2
 updates:
+  # Rust crates. Minor and patch bumps arrive as one grouped PR per week;
+  # major bumps stay separate because they need a real review.
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      cargo-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions used by ci.yml, docs.yml and release.yml.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
-  - package-ecosystem: "cargo"
+  # Astro Starlight documentation site (pnpm workspace in docs/).
+  - package-ecosystem: "npm"
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(docs)"
+    groups:
+      docs-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Base images of the two Dockerfile stages (rust:1-bookworm,
+  # debian:bookworm-slim).
+  - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "chore(docker)"

From 378a74fe37dec4f02ce3bc2f2d7151daf286a297 Mon Sep 17 00:00:00 2001
From: Benjamin Demaille <benjamin.demaille@icloud.com>
Date: Wed, 26 Aug 2026 21:40:44 +0200
Subject: [PATCH 2/2] chore(ci): dependabot monthly with one open PR per
 ecosystem

Review feedback: monthly schedule and open-pull-requests-limit 1 across all
four ecosystems, to cut update noise further. Security update PRs are exempt
from the limit and do not count toward it, so they still arrive immediately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f0a0a824..2cdb08ac 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,12 +1,13 @@
 version: 2
 updates:
-  # Rust crates. Minor and patch bumps arrive as one grouped PR per week;
-  # major bumps stay separate because they need a real review.
+  # Rust crates. Minor and patch bumps arrive as one grouped PR per month;
+  # major bumps stay separate because they need a real review, and queue
+  # behind it (one open version-update PR per ecosystem at a time).
   - package-ecosystem: "cargo"
     directory: "/"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
+      interval: "monthly"
+    open-pull-requests-limit: 1
     commit-message:
       prefix: "chore(deps)"
     groups:
@@ -21,8 +22,8 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
+      interval: "monthly"
+    open-pull-requests-limit: 1
     commit-message:
       prefix: "chore(ci)"
     groups:
@@ -37,8 +38,8 @@ updates:
   - package-ecosystem: "npm"
     directory: "/docs"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
+      interval: "monthly"
+    open-pull-requests-limit: 1
     commit-message:
       prefix: "chore(docs)"
     groups:
@@ -54,7 +55,7 @@ updates:
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
+      interval: "monthly"
+    open-pull-requests-limit: 1
     commit-message:
       prefix: "chore(docker)"