From 4cb5c4788a22d5d07a95af32432b381319ec4064 Mon Sep 17 00:00:00 2001
From: ZProger <zproger@users.noreply.github.com>
Date: Wed, 9 Sep 2026 01:15:33 +0300
Subject: [PATCH] =?UTF-8?q?ci:=20=D0=B3=D1=80=D1=83=D0=BF=D0=BF=D0=B8?=
 =?UTF-8?q?=D1=80=D0=BE=D0=B2=D0=B0=D1=82=D1=8C=20Dependabot-=D0=BE=D0=B1?=
 =?UTF-8?q?=D0=BD=D0=BE=D0=B2=D0=BB=D0=B5=D0=BD=D0=B8=D1=8F=20=D0=BF=D0=BE?=
 =?UTF-8?q?=20minor/patch=20=D0=B8=20major?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Все minor/patch-апдейты одного пакетного менеджера теперь идут одним
PR, а major-обновления — отдельным, чтобы не терялись среди рутинных
и не сыпало десятком PR одновременно.
---
 .github/dependabot.yml | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b07216e..02bc253 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,21 +1,37 @@
 version: 2
 updates:
-  # Frontend npm dependencies.
+  # Frontend npm dependencies. Minor/patch bumps are low-risk and bundled
+  # into one PR; majors (real breaking-change risk) get their own group so
+  # they don't hide inside a pile of safe updates.
   - package-ecosystem: "npm"
     directory: "/frontend"
     schedule:
       interval: "weekly"
+    groups:
+      npm-minor-patch:
+        update-types: ["minor", "patch"]
+      npm-major:
+        update-types: ["major"]
 
-  # Backend pip dependencies.
+  # Backend pip dependencies — same minor/patch vs. major split as npm above.
   - package-ecosystem: "pip"
     directory: "/backend"
     schedule:
       interval: "weekly"
+    groups:
+      pip-minor-patch:
+        update-types: ["minor", "patch"]
+      pip-major:
+        update-types: ["major"]
 
   # The GitHub Actions themselves (actions/checkout, setup-python, ...) used
   # in .github/workflows/ci.yml — these go stale too, and an outdated action
-  # can be its own supply-chain risk.
+  # can be its own supply-chain risk. Few enough that one group for
+  # everything is fine, no minor/major split needed.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      actions:
+        patterns: ["*"]