ci(dependabot): group minor and patch updates, disable npm auto-rebase

.github/dependabot.yml

@@ -10,6 +10,13 @@ updates:
       time: "03:00"
       timezone: Europe/Paris
     open-pull-requests-limit: 10
+    groups:
+      composer:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: npm
     directory: "/"
     schedule:
@@ -18,6 +25,37 @@ updates:
       time: "03:00"
       timezone: Europe/Paris
     open-pull-requests-limit: 10
+    # Assets are committed, so a rebase without a recompile leaves CI red anyway.
+    # Rebase manually alongside /compile when the PR is ready to merge.
+    rebase-strategy: "disabled"
+    cooldown:
+      default-days: 4
+      semver-major-days: 8
+    # Groups are first-match. The production/development split keeps a bundle
+    # regression narrowed to one half; npm-other then catches transitive
+    # dependencies, which dependency-type does not cover for npm and which would
+    # otherwise still land as individual pull requests.
+    groups:
+      npm-production:
+        dependency-type: production
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      npm-development:
+        dependency-type: development
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      npm-other:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: npm
     directory: "/"
     schedule:
@@ -27,6 +65,21 @@ updates:
       timezone: Europe/Paris
     target-branch: stable34
     open-pull-requests-limit: 10
+    rebase-strategy: "disabled"
+    cooldown:
+      default-days: 4
+    groups:
+      npm-production:
+        dependency-type: production
+        patterns:
+          - "*"
+      npm-development:
+        dependency-type: development
+        patterns:
+          - "*"
+      npm-other:
+        patterns:
+          - "*"
     ignore:
       # do not do breaking changes on stable branches
       - dependency-name: "*"
@@ -42,6 +95,10 @@ updates:
       timezone: Europe/Paris
     target-branch: stable34
     open-pull-requests-limit: 10
+    groups:
+      composer:
+        patterns:
+          - "*"
     ignore:
       # do not do breaking changes on stable branches
       - dependency-name: "*"