[ynahmany]

Adds an npm entry to .github/dependabot.yml:

• npm-security: all security fixes in one PR per run. After merge, Dependabot replaces the individual security PRs opened on 2026-10-20 with the grouped one.
• npm-minor-patch: weekly, one PR.
• npm-major: weekly, a separate PR, so a breaking upgrade is reviewed on its own.
• cooldown: 7 days (zizmor dependabot-cooldown); security updates are not delayed by it.

Validated against the Dependabot schema; zizmor clean.

Ticket: PRV-8217.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Chores
  • Automated maintenance checks now run on a weekly schedule.
  • Related updates are grouped by security, minor and patch, and major changes for easier review.
  • A seven-day cooldown helps space out automated update proposals.
  • Updated automation guidance ensures cooldown notifications reference the correct version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: PruvoNet/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Team
• Run ID: b45de78f-8bfa-40e2-a788-1ddb1a4531fd

📥 Commits

Reviewing files that changed from the base of the PR and between 7bf19e2 and 7bef254.

📒 Files selected for processing: 1

• .github/dependabot.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

📝 Walkthrough

The Dependabot configuration retains the seven-day cooldown and grouped GitHub Actions updates. It adds weekly npm updates with a seven-day cooldown and groups for security, minor/patch, and major updates.

Changes: Dependabot update configuration

Layer / File(s)	Summary
Configure dependency update groups .github/dependabot.yml	The GitHub Actions cooldown comment changes. Weekly npm updates use a seven-day cooldown, with security updates, minor/patch updates, and major updates in separate groups.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 7bef2

No merge-blocking risk was identified in the Dependabot configuration.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title uses the Conventional Commits format with the ci: prefix and clearly summarizes the Dependabot npm grouping and weekly update changes.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}