Conversation
The repository had no Dependabot configuration, so nothing was watching
poetry.lock, the SHA-pinned actions in the workflows, or the pinned
pre-commit hook revisions.
Add one, with every update grouped so that a run opens one pull request
per ecosystem rather than one per dependency -- three a week at most,
instead of the dozen or so the same set of bumps would otherwise produce.
Security advisories are grouped the same way, so a batch of them arrives
as one pull request rather than one apiece.
Python updates use lockfile-only. pyproject.toml constrains most
dependencies loosely ("*", "^2.7.0") on purpose, and rewriting those
constraints on every bump is churn against a file that is deliberately
permissive; the lock file is what needs to stay current.
Dependabot can also consolidate across ecosystems into a single pull
request, via the top-level multi-ecosystem-groups key. That is left
unused deliberately: it is a newer feature, and a configuration file
Dependabot rejects stops every update and says so only under Insights ->
Dependency graph -> Dependabot. Per-ecosystem grouping rests on
long-established configuration and gets most of the benefit.
Generated-by: Claude Opus 5
Claude-Session: https://claude.ai/code/session_018yUbPm1PL7tsKZJhXFsfj7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The repository has no Dependabot configuration, so nothing is watching
poetry.lock, the SHA-pinned actions in the workflows, or the pinned hookrevisions in
.pre-commit-config.yaml. The pre-commit pins in particular(
pre-commit-hooks v5.0.0,Lucas-C/pre-commit-hooks v1.5.5) go stale quietly.The reason to configure this rather than just enable it is volume: ungrouped,
the same set of bumps opens a dozen or so separate PRs.
What this does
Every update is grouped, so a run opens one PR per ecosystem — three a week
at most:
pippyproject.toml+poetry.lock(Dependabot reads poetry underpip)github-actionsuses:in.github/workflows/pre-commitrev:of each external hook repoSecurity advisories are grouped the same way (a second group per ecosystem with
applies-to: security-updates), so a batch of them arrives as one PR ratherthan one apiece.
Python uses
versioning-strategy: lockfile-only.pyproject.tomlconstrains most dependencies loosely (
requests = "*",PyGithub = "^2.7.0")on purpose; rewriting those constraints on every bump is churn against a file
that is deliberately permissive. The lock file is what needs to stay current.
The SHA pinning survives. All four
uses:are pinned to a commit SHA with a# v4.2.2-style trailing comment. Dependabot updates both the SHA and thecomment, so the pinning is preserved rather than undone.
No
ignorerules for majors. CI here is fast; a breaking major shouldsurface as a red PR rather than be silently skipped.
One deliberate omission
Dependabot can now consolidate across ecosystems into a single PR, via the
top-level
multi-ecosystem-groupskey. This config does not use it. It is anewer feature, and the failure mode is bad: a config file Dependabot rejects
stops all updates and reports it only under Insights → Dependency graph →
Dependabot. Per-ecosystem grouping rests on long-established configuration and
collapses ~12 PRs to 3, which is most of the benefit. Easy to revisit later.
enable-beta-ecosystems: trueis set for one reason:pre-commitis a recentaddition, and the flag keeps it from being skipped if it is still beta-gated. It
has no effect on the other two.
Testing
Validated against the published Dependabot 2.0 JSON schema
(
json.schemastore.org/dependabot-2.0.json) withjsonschema— full documentvalidation, not a spot check.
versioning-strategy: lockfile-only,applies-to: security-updates, and thepip/github-actions/pre-commitecosystem names were each confirmed present in the schema's enums rather than
assumed. Config-only change; the test suite is untouched.
Worth a maintainer checking the Dependabot tab after merge to confirm the file
is accepted and the first three PRs appear.
🤖 Generated with Claude Code
https://claude.ai/code/session_018yUbPm1PL7tsKZJhXFsfj7