chore(dependabot): security-first posture — ignore majors, keep grouped patch/minor

[KrasimirKralev]

Why

Dependabot is currently emitting risky major version bumps as individual PRs — TypeScript 5→7, @types/node 20→26 (against a Node 22 runtime), jsdom 28→30, jest-dom 6→7 — while its actual value, security-update PRs, is dormant because repo Dependabot alerts are disabled.

For an edge-deployed, network-exposed device OS, stability beats currency for routine deps. This shifts Dependabot to a security-first, low-churn posture.

What changed

• Add ignore rules for version-update:semver-major on the bun and github-actions ecosystems.
• Routine version updates are now grouped patch+minor only; framework majors become an opt-in, by-hand decision.
• Security-update PRs are unaffected — they bypass ignore/group rules and still land when alerts are enabled. Majors that fix a real CVE still come through as security updates.
• The npm open-pull-requests-limit: 0 (security-only) entry is unchanged.

Companion action (admin, not in this PR)

Enable Dependabot alerts in Settings → Code security — that turns on the security-update PRs this config is built around. Without it, the security half stays dormant.

Queue cleanup

The open major-bump PRs (#291, #293, #290, #292, #286, #287, #288) are being closed as superseded by this policy. The grouped patch/minor PR (#289) is kept for a device-build check before merge.

Config file only — no runtime code touched.

Summary by CodeRabbit

• Chores
  • Updated automated dependency update settings to distinguish security updates from routine version updates.
  • Excluded major-version updates for Bun and GitHub Actions.
  • Configured weekly GitHub Actions update checks on the beta branch.
  • Limited open GitHub Actions update proposals to three at a time and grouped minor and patch updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fd5fe83a-c3cc-4a81-950c-346aa2ff3763

📥 Commits

Reviewing files that changed from the base of the PR and between 474b694 and f35ee17.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

📝 Walkthrough

Walkthrough

Dependabot documentation now defines security and routine update behavior. Bun major updates are ignored. GitHub Actions updates run weekly against beta, allow three open pull requests, and ignore major versions.

Changes

Dependabot policy

Layer / File(s)	Summary
Update rules and documentation .github/dependabot.yml	The configuration documents security-first updates, groups routine Bun minor and patch updates, ignores Bun major updates, and adds weekly GitHub Actions updates targeting beta with a three-PR limit and major-version exclusions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: georgik77, yalexx

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description clearly explains the configuration change and rationale, but it omits the required change type, testing, checklist, and screenshot/log sections.	Add the template sections, select the change type, record testing results, complete the checklist, and state whether screenshots or logs are applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the Dependabot policy change to prioritize security updates and ignore routine major updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-security-only

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/dependabot.yml:
- Around line 4-6: Update the explanatory comment near the “Dependabot alerts”
note to require enabling both Dependabot alerts and Dependabot security updates
in repository settings, while preserving the existing description of
security-update PR behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 41dada55-08e6-4a2e-9452-43a5f4eb3ac7

📥 Commits

Reviewing files that changed from the base of the PR and between 8cb6a43 and 474b694.

📒 Files selected for processing (1)

• .github/dependabot.yml

[github-actions]

🦀 ClawReview

Claws waving — here's what this change is about.

This PR tightens ClawBox's Dependabot posture to security-first by adding ignore rules for major-version bumps on the bun and github-actions ecosystems, so routine update PRs only surface minor and patch changes. Security-update PRs are explicitly unaffected and still bypass the ignore/group rules whenever Dependabot alerts are enabled. Only .github/dependabot.yml is modified — no runtime code touched.

At a glance

• 🧹 Chore · touches CI / Dependabot config
• Base branch: main · +22 source / +0 tests across 1 file
• ✅ base main matches the beta-first convention (docs/meta-only change)
• ✅ conventional PR title

Good to know

• 🟡 Companion admin step required: 'Dependabot alerts' AND 'Dependabot security updates' must both be enabled in Settings → Code security for the security-update half to actually open PRs.
• ℹ️ Seven open major-bump PRs (chore(deps): bump actions/upload-artifact from 4 to 7 #286–chore(deps): bump actions/github-script from 7 to 9 #288, chore(deps-dev): bump jsdom from 28.1.0 to 30.0.1 #290–chore(deps-dev): bump @types/node from 20.19.33 to 26.1.2 #293) are being closed as superseded by this policy; chore(deps): bump the minor-and-patch group with 15 updates #289 (grouped patch/minor) is kept for a device-build check.
• ℹ️ Security-update PRs always target the default branch and only bump package-lock.json — a bun install run is still needed to refresh bun.lock before merging any that land.

_{— ClawReview 🦀, scuttling off. General info only — see CodeRabbit for the detailed review. Conventions: docs.}

[github-actions]

CI Summary

✅ Tests

• Result: passed
• View run
• Coverage: statements 70.1%, branches 60.1%, functions 65.41%, lines 72.07%

✅ E2E

• Result: passed
• View run

✅ E2E Install

• Result: success
• View run