From 477c5d6f4fc3f54bd320e70ce82a9b02ee6c519f Mon Sep 17 00:00:00 2001
From: bilby91 <2201079+bilby91@users.noreply.github.com>
Date: Wed, 4 Nov 2026 17:32:26 +0000
Subject: [PATCH] ci(dependabot): security updates only

Dependabot ran weekly version updates for gomod and github-actions
(open-pull-requests-limit: 5). Track security advisories only, as
crunchloop/dap does: open-pull-requests-limit: 0 turns version updates
off, and security updates do not count against it. The moby and
opentelemetry lockstep groups now apply to security updates, the only
updates left. The schedule's day and time are dropped: they pace
version updates only.

Security updates are enabled in the repository settings, not here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4b1aae4..8a332ba 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,23 +1,31 @@
+# Dependabot: security updates only.
+#
+# `open-pull-requests-limit: 0` turns off version updates for each
+# ecosystem. Security updates are not counted against that limit, so
+# Dependabot still opens a pull request whenever an advisory has a fixed
+# version; the schedule only paces version updates and is otherwise unused.
+#
+# Security updates themselves are switched on in the repository settings
+# (Settings > Code security > Dependabot security updates), not here.
 version: 2
 updates:
   - package-ecosystem: gomod
     directory: /
     schedule:
       interval: weekly
-      day: monday
-      time: "06:00"
-      timezone: Etc/UTC
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 0
     commit-message:
       prefix: deps
     groups:
       # Bundle Docker SDK packages so the moby/moby/api ↔ moby/moby/client
       # versions move together.
       moby:
+        applies-to: security-updates
         patterns:
           - github.com/moby/moby/*
       # OpenTelemetry packages release in lockstep; one PR per bump.
       opentelemetry:
+        applies-to: security-updates
         patterns:
           - go.opentelemetry.io/*
 
@@ -25,9 +33,6 @@ updates:
     directory: /
     schedule:
       interval: weekly
-      day: monday
-      time: "06:00"
-      timezone: Etc/UTC
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 0
     commit-message:
       prefix: ci