From 7bef2543dc05986ab8f21834ca3949070d4a938b Mon Sep 17 00:00:00 2001
From: Yohay Nahmany <yohay.arch@gmail.com>
Date: Wed, 21 Oct 2026 12:22:19 +0200
Subject: [PATCH] ci: Dependabot for npm: grouped security fixes and weekly
 version updates [PRV-8217]

Security fixes land as one grouped PR per run instead of one PR per
advisory. Weekly version updates: minor and patch in one PR, majors in a
separate PR so a breaking upgrade is reviewed on its own. Same 7-day
cooldown as the github-actions entry.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a12f510..7ccf7ce 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,10 +5,37 @@ updates:
     directory: /
     schedule:
       interval: weekly
-    # Wait a week after a release: a hijacked action version is usually caught and pulled by then.
+    # Wait a week after a release: a hijacked version is usually caught and pulled by then.
     cooldown:
       default-days: 7
     groups:
       github-actions:
         patterns:
           - '*'
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      # All security fixes in one PR per run, instead of one PR per advisory.
+      npm-security:
+        applies-to: security-updates
+        patterns:
+          - '*'
+      npm-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+        patterns:
+          - '*'
+      # Majors can break consumers: kept apart so they are reviewed on their own.
+      npm-major:
+        applies-to: version-updates
+        update-types:
+          - major
+        patterns:
+          - '*'