chore(dependabot): security-first posture — ignore majors, keep grouped patch/minor

[KrasimirKralev]

Why

Dependabot is currently emitting risky major version bumps as individual PRs — TypeScript 5→7, @types/node 20→26 (against a Node 22 runtime), jsdom 28→30, jest-dom 6→7 — while its actual value, security-update PRs, is dormant because repo Dependabot alerts are disabled.

For an edge-deployed, network-exposed device OS, stability beats currency for routine deps. This shifts Dependabot to a security-first, low-churn posture.

What changed

• Add ignore rules for version-update:semver-major on the bun and github-actions ecosystems.
• Routine version updates are now grouped patch+minor only; framework majors become an opt-in, by-hand decision.
• Security-update PRs are unaffected — they bypass ignore/group rules and still land when alerts are enabled. Majors that fix a real CVE still come through as security updates.
• The npm open-pull-requests-limit: 0 (security-only) entry is unchanged.

Companion action (admin, not in this PR)

Enable Dependabot alerts in Settings → Code security — that turns on the security-update PRs this config is built around. Without it, the security half stays dormant.

Queue cleanup

The open major-bump PRs (#291, #293, #290, #292, #286, #287, #288) are being closed as superseded by this policy. The grouped patch/minor PR (#289) is kept for a device-build check before merge.

Config file only — no runtime code touched.

Summary by CodeRabbit

• Chores
  • Updated automated dependency update settings.
  • Grouped routine minor and patch updates while excluding major-version updates.
  • Configured weekly GitHub Actions checks with a limit on open update proposals.

[coderabbitai]

📝 Walkthrough

Walkthrough

Dependabot documentation now defines security and routine update behavior. Bun major updates are ignored. GitHub Actions updates run weekly against beta, allow three open pull requests, and ignore major versions.

Changes

Dependabot policy

Layer / File(s)	Summary
Update rules and documentation .github/dependabot.yml	The configuration documents security-first updates, groups routine Bun minor and patch updates, ignores Bun major updates, and adds weekly GitHub Actions updates targeting beta with a three-PR limit and major-version exclusions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: georgik77, yalexx

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the configuration changes and rationale but omits the required Summary, Type of change, testing, checklist, and screenshots sections.	Add the template sections, record testing results, complete the checklist, and state whether screenshots or logs are not applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Dependabot policy change and its focus on ignoring major updates while grouping patch and minor updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-security-only

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/dependabot.yml:
- Around line 4-6: Update the explanatory comment near the “Dependabot alerts”
note to require enabling both Dependabot alerts and Dependabot security updates
in repository settings, while preserving the existing description of
security-update PR behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 41dada55-08e6-4a2e-9452-43a5f4eb3ac7

📥 Commits

Reviewing files that changed from the base of the PR and between 8cb6a43 and 474b694.

📒 Files selected for processing (1)

• .github/dependabot.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== dependabot.yml =="
cat -n .github/dependabot.yml | sed -n '1,90p'

echo
echo "== git status/stat =="
git status --short || true
git diff --stat || true

echo
echo "== search dependency/security settings docs in repo =="
rg -n "Dependabot (security updates|alerts)|code security|security-update|github-code-scanning|dependabot-security" .github README.md 2>/dev/null || true

Repository: ID-Robots/clawbox

Length of output: 2825

---

🌐 Web query:

GitHub Dependabot alerts security updates separate setting security-update pull requests documentation

💡 Result:

Dependabot alerts and Dependabot security updates are two distinct but related features in GitHub [1]. While they are both part of GitHub's supply chain security tools, they function differently and are managed through separate settings [1][2]. Dependabot alerts Dependabot alerts are notifications that inform you about vulnerable dependencies within your project [3][4]. When enabled, GitHub monitors your repository's dependency graph and alerts you whenever a known security vulnerability is detected in one of your dependencies [1][3]. These alerts are primarily informational, designed to help you identify and manage risks [3][4]. Dependabot security updates Dependabot security updates are an automated remediation feature [1]. When this feature is enabled, GitHub automatically attempts to create a pull request to update a vulnerable dependency to a secure version as soon as a Dependabot alert is raised [1][5]. Key Differences and Relationship - Settings: Dependabot alerts and security updates have separate settings in your repository's "Settings" tab under "Code security and analysis" [1][6][2]. - Dependency: Dependabot security updates rely on the presence of Dependabot alerts; specifically, a security update pull request is triggered by the generation of a Dependabot alert for a dependency on your default branch [1][5]. - Configuration: While the core feature for security updates is toggled in the repository settings, you can further customize how these pull requests are raised (e.g., grouping, labels, assignees) by adding a dependabot.yml file to your repository [6][2]. - Interaction: There is no direct interaction between the dependabot.yml file's version update schedules and security updates, as security updates are triggered immediately by security advisories rather than by a schedule [5]. Merging a security update pull request will automatically mark the corresponding Dependabot alert as resolved [1][5]. In summary, Dependabot alerts provide the notification of a vulnerability, and Dependabot security updates provide the automated pull request to fix it [1][3]. You can choose to enable alerts without enabling automatic security updates, but security updates cannot function without the underlying alerts enabled [1].

Citations:

• 1: https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-security-updates
• 2: https://docs.github.com/en/code-security/concepts/supply-chain-security/about-the-dependabot-yml-file
• 3: https://docs.github.com/en/enterprise-cloud@latest/code-security/concepts/supply-chain-security/dependabot-alerts
• 4: https://github.com/github/docs/blob/main/content/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository.md
• 5: https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-pull-requests
• 6: https://docs.github.com/github/managing-security-vulnerabilities/configuring-dependabot-security-updates

---

Enable Dependabot security updates separately.

Dependabot alerts create vulnerability notifications; Dependabot security updates create the automatic security-update PRs. Update this note to require both settings.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 4 - 6, Update the explanatory comment
near the “Dependabot alerts” note to require enabling both Dependabot alerts and
Dependabot security updates in repository settings, while preserving the
existing description of security-update PR behavior.