justinmclean opened a new pull request, #4541: URL: https://github.com/apache/iggy/pull/4541
## Which issue does this PR address? N/A ## Rationale ASF Infra asks projects to batch Dependabot security updates, since each one otherwise opens its own PR and full CI run on the shared runner queue (https://infra.apache.org/services.html#github-actions). ## What changed? The `groups` blocks in dependabot.yml only apply to version updates, which is Dependabot's default. Weekly bumps arrived as one PR per ecosystem, but security alerts still opened one PR per dependency, each with its own Pre-merge run. Each ecosystem now has a second group with `applies-to: security-updates`, so alerts that fire together in one ecosystem arrive as one PR. Schedules, cooldown, reviewers and labels are unchanged. ## Local Execution - Passed: the file parses as YAML and every ecosystem lists its two groups. Dependabot itself only runs on GitHub. - Pre-commit hooks ran ## AI Usage 1. Claude (Claude Code). 2. Compared the config against the Infra guidance and added the security groups. 3. Parsed the YAML and read the diff by hand; the first batched security PR is the real test. 4. Yes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
