From 7d951385a2e0bb7afb8ba43bf6ac52b7b87bd440 Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:51:28 +0000 Subject: [PATCH 1/2] Run Dependabot updates weekly We now review dependency updates weekly rather than daily, so daily update runs only generate churn. Check for updates once a week on Monday morning instead. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 67ea0546..5c2a0763 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,7 +3,8 @@ updates: - package-ecosystem: npm directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' open-pull-requests-limit: 20 groups: @@ -18,7 +19,8 @@ updates: - package-ecosystem: github-actions directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' cooldown: default-days: 7 From 5a75ceb6af2fb7ca11b0eb715dd6d7eebe6852e7 Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:51:45 +0000 Subject: [PATCH 2/2] Group CodeQL action updates Dependabot treats the github/codeql-action subpath actions (init, analyze, autobuild) as separate dependencies and opens a separate PR for each. CI fails unless they are all updated together. Group them so that they arrive as a single PR. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5c2a0763..8961f954 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,5 +22,9 @@ updates: interval: weekly day: monday time: '14:00' + groups: + codeql: + patterns: + - github/codeql-action* cooldown: default-days: 7