From 42ae7b6e2425f5975780ef9a9a9d1e6107593b13 Mon Sep 17 00:00:00 2001
From: Goran Dodig <goran@dodig.org>
Date: Tue, 27 Oct 2026 13:55:31 +0100
Subject: [PATCH] ci: group Dependabot pip updates and use chore(deps) prefix

One weekly minor/patch PR instead of single-dependency PRs capped at 3, with a 2-day cooldown. The old "dependabot:" prefix was not a Conventional Commits type.
---
 .github/dependabot.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 563b00d1..a8176d9a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,11 +4,22 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 3
+    # Skip releases younger than two days. Security updates are never delayed.
+    cooldown:
+      default-days: 2
+    open-pull-requests-limit: 5
+    # "chore(deps): ..." — also applies to pip security update PRs.
     commit-message:
-      prefix: "dependabot"
+      prefix: "chore"
+      include: "scope"
     labels:
       - "dependencies"
+    # Routine bumps arrive as one weekly PR; majors stay separate.
+    groups:
+      pip-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
 
   # Keeps the SHA-pinned actions in publish-to-pypi.yml patched.
   - package-ecosystem: "github-actions"