This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch group-dependabot-security-updates in repository https://gitbox.apache.org/repos/asf/airflow-site.git
commit d0c05700e04442a1161d21029460407be23e5fad Author: Jarek Potiuk <[email protected]> AuthorDate: Mon Jul 27 20:09:48 2026 +0200 Group Dependabot security updates Version-update groups only apply to security updates when they declare `applies-to: security-updates`. Without it, every alert-driven bump opened its own PR - shell-quote (#1608), fast-uri (#1607), immutable (#1605), svgo (#1604), launch-editor (#1568) and qs+express (#1541) all landed individually while regular version updates were bundled. Add a parallel security-updates group for the npm and github-actions ecosystems so those bumps are batched too. pre-commit is left alone - Dependabot does not issue security updates for that ecosystem. Generated-by: Claude Opus 5 (1M context) --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8f0f50307b..9fc4960a4e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -28,6 +28,11 @@ updates: interval: daily groups: npm-dependencies: + applies-to: version-updates + patterns: + - "*" + npm-security: + applies-to: security-updates patterns: - "*" - package-ecosystem: github-actions @@ -38,6 +43,11 @@ updates: interval: daily groups: github-actions: + applies-to: version-updates + patterns: + - "*" + github-actions-security: + applies-to: security-updates patterns: - "*" - package-ecosystem: pre-commit
