[gpambrozio]

Dependabot opened four PRs on 2026-10-07 (#64, #82, #83, #84) — all lockfile-only bumps of transitive dev tooling. They were security updates, which is why the existing all-dependencies group didn't catch them: a group applies to version updates only unless it says applies-to: security-updates. #82/#83 also had Dependabot's default build(deps-dev) prefix because /herald was missing from directories, so it got no config at all.

Changes (.github/dependabot.yml only)

• Adds /herald. All six plugin folders with a package.json are now covered.
• Adds a second group, security (applies-to: security-updates, patterns: ["*"]). The existing group now states applies-to: version-updates explicitly.
• Changes schedule.interval from weekly to monthly.
• Lowers open-pull-requests-limit from 3 to 1.
• Keeps the ignore list, its reasons and the deps commit prefix. GitHub documents both ignore and commit-message as applying to security updates as well as version updates.
• No github-actions entry was added, because the repo never had one.

What Dependabot will do now

• Version updates: at most one PR a month for the whole repo. A group over directories already makes a single PR across every folder, as deps: bump the all-dependencies group across 5 directories with 5 updates #77 shows ("bump the all-dependencies group across 5 directories"), and the limit of 1 holds back a second one while that PR is open.
• Security updates: each Dependabot run puts every alert it fixes into one grouped deps: PR, across all packages and all six folders. On 10-07 that would have been one PR, not four.

What config can't do

• Security updates have no limit or schedule. GitHub says they "are not subject to [open-pull-requests-limit] and do not count toward it", and they run when an advisory lands. Alerts that arrive at different times can still mean more than one security PR. build(deps-dev): bump shell-quote from 1.10.0 to 1.12.0 in /herald #82 and deps: bump shell-quote from 1.10.0 to 1.12.0 in /github-board #84 were 16 minutes apart, and grouping only merges alerts that the same run handles. The only way to stop separate security PRs completely is to turn off the repository's "Dependabot security updates" setting. That would leave alerts with no automatic fix PRs. I didn't change that setting.
• A security PR and the monthly version PR can be open at the same time, because the two kinds are counted separately.
• multi-ecosystem-groups wasn't used. It is documented for combining different ecosystems, not several folders of one. It has no applies-to for security updates, and a beta user's attempt to add one failed schema validation (dependabot-core#12437). It also doesn't give anything that the plain directories group doesn't already do here.

Validation

• The file validates against SchemaStore's dependabot-2.0 schema (ajv). A deliberately wrong applies-to value fails, which shows the check really runs.
• GitHub has no dry-run API for dependabot.yml. It checks the file once it is on main, and any problems show under Insights → Dependency graph → Dependabot.
• check-plugin-consistency.mjs passes for all six plugins. No plugin code or version changed, so no release is involved.

🤖 Generated with Claude Code