From bf5595a43308c7b3640074d1429ed5aa23d9691d Mon Sep 17 00:00:00 2001 From: Brady Holt Date: Thu, 20 Aug 2026 08:49:31 -0500 Subject: [PATCH] Limit Dependabot to minor and patch version updates Allow only semver-minor and semver-patch bumps for every ecosystem so breaking upgrades get taken on deliberately instead of arriving as routine dependency PRs. --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f73ee00..9b86a2e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,11 @@ updates: open-pull-requests-limit: 3 cooldown: default-days: 7 + allow: + - dependency-name: "*" + update-types: + - "version-update:semver-minor" + - "version-update:semver-patch" - package-ecosystem: "github-actions" directory: "/" schedule: @@ -20,3 +25,8 @@ updates: open-pull-requests-limit: 3 cooldown: default-days: 7 + allow: + - dependency-name: "*" + update-types: + - "version-update:semver-minor" + - "version-update:semver-patch"