Repository navigation
chore(deps): group Dependabot updates per ecosystem - #73
Merged
Merged
Conversation
Dependabot opens one pull request per dependency by default. Add a `groups:` block to each `updates:` entry so each package ecosystem is maintained in a single pull request instead. Schedules, labels, commit-message settings and limits are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a
groups:block to the Dependabot configuration so that Dependabot raisesone pull request per package ecosystem instead of one pull request per
dependency.
Why
Dependabot's documented default behaviour, when no groups are configured, is:
This repository has no
groups:configuration, and the result is visible in thepull request history — every update arrives on its own:
Bump prometheus-client from 0.25.0 to 0.26.0Bump kubernetes from 36.0.2 to 36.0.3Bump actions/cache from 5 to 6Bump actions/checkout from 6 to 7Bump kubernetes from 35.0.0 to 36.0.2Since 2026-05-01: 12 individual pull request(s), 3 grouped.
Changes
.github/dependabot.ymldockerdocker-dependenciesgithub-actionsgithub-actionsgomodgo-dependenciespippip-dependenciesEach group uses
patterns: ["*"], so every dependency matching the ecosystemis combined into a single pull request.
Notes
open-pull-requests-limitandtarget-branchare unchanged. The only difference is the addedgroups:block.groupsapplies to version updates. Dependabot'sapplies-todefault isversion-updates, so security updates continue to be raised separately.repositories (
go-dependencies,github-actions,docker-dependencies,pip-dependencies).