From 30884ef658d70c55f69c1f8b0e357041c1340972 Mon Sep 17 00:00:00 2001 From: or-akl <147986571+or-akl@users.noreply.github.com> Date: Thu, 29 Oct 2026 12:13:12 +0200 Subject: [PATCH 1/2] chore: add Dependabot version updates for all package ecosystems Weekly checks, one PR per available bump, up to 100 open PRs per ecosystem. Part of the org-wide Dependabot rollout. Co-Authored-By: Claude Fable 5.1 --- .github/dependabot.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..139dfab6 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,20 @@ +# Dependabot version updates: one PR per available dependency bump, checked weekly, +# for every package ecosystem found in this repo. GitHub's default 3-day cooldown +# on newly published versions applies. Managed org-wide by AppSec. +version: 2 +updates: +- package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 100 +- package-ecosystem: maven + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 100 +- package-ecosystem: gradle + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 100 From 494d582c814e00d2aec1c2ac6ba764cbdbf1b847 Mon Sep 17 00:00:00 2001 From: or-akl <147986571+or-akl@users.noreply.github.com> Date: Thu, 29 Oct 2026 12:59:55 +0200 Subject: [PATCH 2/2] chore: clarify the open-PR cap in the Dependabot header Addresses CodeRabbit review. Co-Authored-By: Claude Fable 5.1 --- .github/dependabot.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 139dfab6..4488ea78 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,7 @@ -# Dependabot version updates: one PR per available dependency bump, checked weekly, -# for every package ecosystem found in this repo. GitHub's default 3-day cooldown -# on newly published versions applies. Managed org-wide by AppSec. +# Dependabot version updates: checked weekly for every package ecosystem found in +# this repo, one PR per available bump, up to 100 open PRs per ecosystem (Dependabot +# pauses opening more until some are closed). GitHub's default 3-day cooldown on +# newly published versions applies. Managed org-wide by AppSec. version: 2 updates: - package-ecosystem: github-actions