From 85dc2cda444d686570d568bed0b3044b7a3f7f42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Enrique=20Lo=CC=81pez=20Man=CC=83as?= Date: Mon, 21 Sep 2026 08:51:11 +0200 Subject: [PATCH 1/3] ci: group dependabot minor and patch updates dependabot.yml sets no groups, so every dependency bump opens its own PR with its own CI run. Group minor and patch updates per ecosystem into a single weekly PR, and leave majors ungrouped so they are still reviewed individually. --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b32dd756b..5ae7c4e16 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,6 +21,12 @@ updates: open-pull-requests-limit: 10 commit-message: prefix: chore(deps) + # Collapse routine minor/patch bumps into a single PR per ecosystem. + # Majors stay on their own so they still get individual review. + groups: + gradle-minor-and-patch: + patterns: ["*"] + update-types: ["minor", "patch"] - package-ecosystem: "github-actions" directory: "/" # Location of package manifests schedule: @@ -28,3 +34,7 @@ updates: open-pull-requests-limit: 10 commit-message: prefix: chore(deps) + groups: + github-actions-minor-and-patch: + patterns: ["*"] + update-types: ["minor", "patch"] From c1bd282fdb1e40ead49408818f29044abd654c7f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Enrique=20Lo=CC=81pez=20Man=CC=83as?= Date: Mon, 21 Sep 2026 08:57:40 +0200 Subject: [PATCH 2/3] ci: add dependabot cooldown zizmor audits dependabot.yml and flags each update entry without a cooldown as a Medium finding, which fails the zizmor-output check. It only scans changed files, so the finding was latent until this PR touched the file. Cooldown also stands on its own: letting a release age before adopting it narrows the window in which a compromised or immediately-yanked version gets pulled in. --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5ae7c4e16..08468e37b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,6 +18,13 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" + # Let a release sit before adopting it, narrowing the window in which a + # compromised or immediately-yanked version can be pulled in. + cooldown: + default-days: 7 + semver-major-days: 14 + semver-minor-days: 7 + semver-patch-days: 3 open-pull-requests-limit: 10 commit-message: prefix: chore(deps) @@ -31,6 +38,13 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" + # Let a release sit before adopting it, narrowing the window in which a + # compromised or immediately-yanked version can be pulled in. + cooldown: + default-days: 7 + semver-major-days: 14 + semver-minor-days: 7 + semver-patch-days: 3 open-pull-requests-limit: 10 commit-message: prefix: chore(deps) From 55b3be40f850be57f67f7e3a2b9eb4569ce0d7aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Enrique=20Lo=CC=81pez=20Man=CC=83as?= Date: Mon, 21 Sep 2026 10:22:23 +0200 Subject: [PATCH 3/3] fix: drop unsupported cooldown keys for github-actions Dependabot's own config check rejected the file: The property '#/updates/1/cooldown/semver-major-days' is not supported for the package ecosystem 'github-actions'. (same for minor and patch) The semver-*-days breakdown is only valid for ecosystems that carry semver metadata, so github-actions keeps default-days alone. Gradle is unchanged. --- .github/dependabot.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 08468e37b..a8a3eb135 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -42,9 +42,6 @@ updates: # compromised or immediately-yanked version can be pulled in. cooldown: default-days: 7 - semver-major-days: 14 - semver-minor-days: 7 - semver-patch-days: 3 open-pull-requests-limit: 10 commit-message: prefix: chore(deps)