This policy defines how security updates generated by Dependabot are handled.

• Dependabot alerts and PRs for Python dependencies in /uwsgi.
• Dependabot alerts and PRs for GitHub Actions in /.github/workflows.

1. critical
2. high
3. medium
4. low

• Triage start: within 1 business day.
• Fix proposal (PR opened or assigned): within 2 business days.
• Merge target: within 5 business days if CI is green.

1. Open repository Security tab and filter Dependabot alerts by:
   • State: open
   • Severity: critical
2. For each alert, capture:
   • package name
   • manifest path
   • affected versions
   • first patched version
   • linked Dependabot PR (if present)
3. Prefer patch upgrades first.
4. If only a major upgrade is available, document impact and required tests in the PR.

• All required CI checks must pass.
• At least one reviewer approval is required.
• No force merge on failing checks.

1. Confirm alert state changed to fixed/dismissed in Security tab.
2. Confirm no new critical alerts were introduced.
3. Keep follow-up issues for residual high/medium alerts.