[Dani Akash (DaniAkash)]

Routine Dependabot PRs now skip version-update:semver-major for both the bun workspace and github-actions ecosystems via per-ecosystem ignore rules. The existing minor-and-patch group continues to batch low-risk bumps into a single PR per cycle.

Security updates are unaffected — ignore rules do not apply to them — so a CVE that requires a major bump (transitive or direct) will still surface a Dependabot PR. The follow-up step is to close the routine major-bump PRs already open under the previous config; Dependabot will not reopen them under the new rules.

[greptile-apps]

Greptile Summary

This PR adds ignore rules to both Dependabot ecosystems (bun and github-actions) to suppress routine major-version bump PRs while keeping security-driven major bumps active.

• bun ecosystem: adds ignore on version-update:semver-major for all dependencies, with an explanatory comment; the existing minor-and-patch group is unchanged.
• github-actions ecosystem: applies the same ignore rule; no comment is added here, though the behavior is identical.

Confidence Score: 5/5

Config-only change with no runtime code affected; the ignore rules are correctly scoped and do not touch security updates.

Both ignore blocks use the correct version-update:semver-major update-type string, apply to all dependencies via the wildcard, and are placed at the right level in the YAML hierarchy. Dependabot's documented guarantee that ignore rules are bypassed for security advisories means CVE-driven major bumps will still surface. The existing minor-and-patch grouping is untouched. No logic, runtime code, or secrets are involved.

No files require special attention.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds ignore: version-update:semver-major to both bun and github-actions ecosystems; configuration is valid and security updates remain unaffected.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Dependabot weekly run] --> B{Update type?}
    B -->|semver-minor or semver-patch| C[Batched into minor-and-patch group PR]
    B -->|semver-major routine| D[Ignored — no PR opened]
    B -->|semver-major via security advisory| E[Security PR opened regardless of ignore rule]
    C --> F[Single PR per cycle merged normally]
    E --> G[CVE / security fix PR surfaced for review]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Dependabot weekly run] --> B{Update type?}
    B -->|semver-minor or semver-patch| C[Batched into minor-and-patch group PR]
    B -->|semver-major routine| D[Ignored — no PR opened]
    B -->|semver-major via security advisory| E[Security PR opened regardless of ignore rule]
    C --> F[Single PR per cycle merged normally]
    E --> G[CVE / security fix PR surfaced for review]

Loading

_{Reviews (1): Last reviewed commit: "chore(ci): drop major version bumps from..." | Re-trigger Greptile}