I am not sure how exclude-patterns works with a group

See GH tutorial about optimizing the number of PRs submitted. There's also an example in there that uses a cooldown option for certain dependencies. That might also be useful here.

And also, the config docs.

I think security-updates would effectively turn off updates to the group. I have never seen security advisories about mkdocs, mypy, ruff, etc.

But I'm willing to try this. I still suspect the patterns are not actually grouping the dependencies like expected.

There's also an example in there that uses a cooldown option for certain dependencies.

Interesting option.

But I'm willing to try this.

Let's try this first, then try cooldown if it does not work well.

Walkthrough

Dependabot configuration in .github/dependabot.yml was modified for the uv package ecosystem: in the dev and docs groups, the update-types array was removed and replaced with applies-to: "security-updates", constraining those groups to security updates only.

Changes

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

dependencies

Suggested reviewers

• 2bndy5

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}