[imnasnainaec]

Resolves #4395

Summary

Dependabot groups default to applies-to: version-updates, so pip security updates were opened as one PR per dependency per directory. This adds a separate group for security updates.

 - package-ecosystem: "pip"
   ...
   groups:
     python-deps:
       patterns:
         - "*"
+    python-security:
+      applies-to: security-updates
+      patterns:
+        - "*"

Evidence

• Before: separate pip security PRs, including one per directory for the same bump: Bump oauthlib from 3.3.1 to 4.0.0 in /deploy #4381, Bump oauthlib from 3.3.1 to 4.0.0 #4382 (oauthlib), Bump urllib3 from 2.6.3 to 2.8.0 in /deploy #4383, Bump urllib3 from 2.6.3 to 2.8.0 in /maintenance #4386 (urllib3), Bump virtualenv from 21.2.1 to 21.7.13 #4385 (virtualenv), Bump pymongo from 4.16.0 to 4.18.2 in /maintenance #4389 (pymongo).
  After: can't be checked until this is on master. Dependabot should then replace those with one grouped pip security PR.

Merge Danger

Door: two-way

Config only; reverting restores the current behavior.

Blast Radius: Dependabot

Only affects how pip security PRs are bundled. Version updates and other ecosystems are unchanged.

🤖 Generated with Claude Code

---

This change is 

Summary by CodeRabbit

• Chores
  • Security-related package update requests are now grouped together, making them easier to review and manage. This change affects update organization only; it does not add or remove app features or change how the product works.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a43f40ac-0ddc-437e-aa42-e96ab8a86810

📥 Commits

Reviewing files that changed from the base of the PR and between 1f1c80d and 863e491.

📒 Files selected for processing: 1

• .github/dependabot.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The Dependabot pip configuration adds a group for security updates. The group applies only to security updates and matches all dependencies.

Changes: Pip security update grouping

Layer / File(s)	Summary
Configure the security update group .github/dependabot.yml	Adds the python-security group for pip security updates and matches all dependencies.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Feature · Severity of issue fixed: Low

Merge Risk: ⚪ Minimal · up to 863e4

The configuration groups pip security updates across /, /deploy, and /maintenance. No identified issue prevents merging.

Pre-merge checks: 5

Check name	Status	Explanation
Linked Issues check		Issue #4395 requires a separate pip security-update group beside the existing version-update group. The change adds python-security with applies-to: security-updates and pattern * in `.github/de…
Out of Scope Changes check		The diff changes only the pip Dependabot configuration. It adds the security-update grouping requested by issue #4395. No changes affect version-update grouping or other ecosystems.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: grouping Dependabot security updates for pip.

Full details: Linked Issues check

Explanation

Issue #4395 requires a separate pip security-update group beside the existing version-update group. The change adds python-security with applies-to: security-updates and pattern * in .github/dependabot.yml. This matches the requested configuration for the existing pip update entry. Dependabot behavior after merge cannot be verified in the repository, but the coding requirement is implemented.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.26%. Comparing base (1f1c80d) to head (863e491).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4396   +/-   ##
=======================================
  Coverage   76.26%   76.26%           
=======================================
  Files         305      305           
  Lines       11452    11452           
  Branches     1409     1409           
=======================================
  Hits         8734     8734           
  Misses       2324     2324           
  Partials      394      394           

Flag	Coverage Δ
backend	87.55% <ø> (ø)
frontend	67.09% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jasonleenaylor]

LGTM

This review was assisted by Claude Opus 5.5.