[bilby91]

Dependabot ran weekly version updates for gomod and github-actions, with up to 5 open PRs per ecosystem. All 29 Dependabot PRs in this repo's history are version bumps; none is a security update. This switches the config to track security advisories only, using the same approach as crunchloop/dap (#7555 there).

Changes

• Version updates off: both ecosystems get open-pull-requests-limit: 0. Security updates don't count against that limit, so security PRs still open whenever an advisory has a fixed version.
• Groups kept: the moby and opentelemetry lockstep groups exist so related packages move together, and a security bump needs that too. Both now have applies-to: security-updates.
• Schedule trimmed: the day/time/timezone settings are removed, since they only pace version updates. schedule itself is still required by the config format.

Before merging

• Repo settings: Dependabot security updates (and alerts) are switched on in Settings › Code security, not in dependabot.yml. Confirm they're enabled, or Dependabot will open nothing once version updates are off. The token I used gets 403 on that setting, so I couldn't check it.
• Open version-bump PRs: deps: bump github.com/compose-spec/compose-go/v2 from 2.14.0 to 2.16.2 #142, deps: bump golang.org/x/term from 0.45.0 to 0.47.0 #141, deps: bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 #133 and deps: bump the moby group across 1 directory with 2 updates #131 stay open after this merges, because Dependabot doesn't close existing PRs when version updates are turned off. Merge or close them as wanted.

Verification

The YAML parses. gomod and github-actions both have limit 0, and both groups apply to security updates. Dependabot validates the file again after merge (Insights › Dependency graph › Dependabot).

🤖 Generated with Claude Code

[dap-code-review-by-crunchloop]

Code Review — 477c5d6 · CLEAN

No concrete defect found in the single-commit change to .github/dependabot.yml; the configuration now limits both ecosystems to security updates and scopes the existing package groups accordingly.

What I reviewed

Coverage: Reviewed correctness, interface-contract, and operability for the one changed file against the core review prompt; .dap/code-review.yml is absent at the governing base SHA, so the repository-specific review standard was not available. Compared the exact head 477c5d6f4fc3f54bd320e70ce82a9b02ee6c519f with its one-commit, one-file change from base 8f740f1dc0f7c3b7d07e8f2583f45f3b473b220f. The config retains a required schedule, sets open-pull-requests-limit: 0 for both ecosystems, and applies the existing groups to security updates. The repository-level Dependabot security-updates setting remains unverified: querying it returned HTTP 403, and the PR body likewise says it needs confirmation before merge; this external prerequisite is not evidence that the setting is currently off. Conditional state-integrity, redelivery, and version-compatibility dimensions do not apply.

---

_{CLEAN — this round found nothing. Reply in a finding's own thread to argue it. On the pull request I answer @dap-code-review-by-crunchloop review, pause and resume.}

[dap-code-review-by-crunchloop]

No open findings on 477c5d6.

_{The DAP Code Review check run remains the verdict of record. This approval is dismissed if a finding reopens or a later head is not clean.}