chore(ci): group uv patch/minor Dependabot updates

[Vidit-Ostwal]

Add a patch-minor-updates group for routine version bumps while keeping the existing security-updates grouping. Ignore sever-major updates so breaking upgrades stay manual.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e381823a-d375-4144-bd1f-63ad27b537b3

📥 Commits

Reviewing files that changed from the base of the PR and between 9d659a6 and a178c78.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

📝 Walkthrough

Walkthrough

Changes

Dependabot update policy

Layer / File(s)	Summary
Configure update policy .github/dependabot.yml	The configuration schedules weekly updates on Mondays, limits open pull requests to 10, groups patch and minor updates, and ignores major updates.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Dependabot grouping change for uv patch and minor updates.
Description check	✅ Passed	The description accurately describes the Dependabot grouping and the decision to ignore major updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Vidit-Ostwal]

What patch/minor Dependabot PRs will look like after merge

This PR does not change security updates — the existing security-updates group stays as-is (one grouped PR when CVEs hit packages in uv.lock).

What is new is the patch-minor-updates group: routine non-security bumps within existing version constraints get batched into one weekly PR instead of many individual ones.

---

Example: grouped patch/minor PR

Field	Example
Author	dependabot[bot]
Title	Bump the patch-minor-updates group across 7 directories with 12 updates
Branch	dependabot/uv/patch-minor-updates-<hash>
Files changed	Workspace pyproject.toml files + uv.lock

PR body (typical):

Bumps the patch-minor-updates group with 12 updates in the uv directory:

| Package | From | To | Type |
|---------|------|-----|------|
| pytest | 9.0.3 | 9.0.4 | patch |
| ruff | 0.15.1 | 0.15.2 | patch |
| mypy | 1.19.1 | 1.19.2 | patch |
| httpx | 0.28.1 | 0.28.2 | patch |
| pydantic | 2.12.5 | 2.12.6 | patch |
| commitizen | 4.13.9 | 4.14.0 | minor |
| click | 8.1.8 | 8.2.0 | minor |
| ... | | | |

Sample diff (root dev deps):

 [dependency-groups]
 dev = [
-    "ruff==0.15.1",
-    "pytest==9.0.3",
+    "ruff==0.15.2",
+    "pytest==9.0.4",
 ]

Sample diff (uv.lock):

 [[package]]
 name = "pytest"
-version = "9.0.3"
+version = "9.0.4"

CI runs the same checks as any other PR (tests, linter, type-checker, pip-audit).

---

What is excluded

Update type	Behavior
Security (CVE)	Existing security-updates group — unchanged
Patch/minor	New patch-minor-updates group — this PR
Major (semver-major)	Ignored — no automatic PR; handle manually

---

Schedule

• Weekly on Monday (aligned with day: monday in config)
• Up to 10 concurrent open Dependabot PRs (open-pull-requests-limit)

After merge, the first patch/minor grouped PR should appear within ~24h (or trigger manually via Insights → Dependency graph → Dependabot → Check for updates).

[Vidit-Ostwal]

Which files change on patch/minor Dependabot PRs?

Both uv.lock and pyproject.toml can change — but not always every workspace pyproject.toml on every PR.

File	When it changes
uv.lock	Almost always — any bumped package in the resolved lockfile is updated here
pyproject.toml	Only when a direct dependency constraint changes — e.g. pytest==9.0.3 → pytest==9.0.4, or httpx~=0.28.1 → httpx~=0.28.2

A typical grouped patch/minor PR will touch one or more workspace pyproject.toml files + the shared uv.lock.

---

Both change — pinned dev dep (root pyproject.toml)

# pyproject.toml
-    "pytest==9.0.3",
+    "pytest==9.0.4",

# uv.lock
 name = "pytest"
-version = "9.0.3"
+version = "9.0.4"

Both change — runtime dep (lib/crewai/pyproject.toml)

# lib/crewai/pyproject.toml
-    "httpx~=0.28.1",
+    "httpx~=0.28.2",

# uv.lock
 name = "httpx"
-version = "0.28.1"
+version = "0.28.2"

Only uv.lock changes — transitive dependency

# uv.lock only (not declared in any pyproject.toml)
 name = "certifi"
-version = "2025.1.31"
+version = "2025.4.26"

---

What usually does not change

• override-dependencies block in root pyproject.toml — manual policy floor pins
• Template pyproject.toml files under lib/cli/src/crewai_cli/templates/
• Internal synced pins like crewai==1.15.10 / crewai-core==1.15.10 (unless Dependabot explicitly targets them)

Short answer: uv.lock is always involved; pyproject.toml only changes for direct deps whose declared version/constraints are bumped.

[theCyberTech]

LGTM