From 75c0b0c33afb9897eb2800b0d04658f70c4d87c3 Mon Sep 17 00:00:00 2001 From: CaliBrain Date: Sun, 14 Jun 2026 01:19:08 -0400 Subject: [PATCH] Update dependabot.yml (#1060) --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 64ffc6b..0a92397 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -42,7 +42,15 @@ updates: open-pull-requests-limit: 5 groups: docker-base-image-digests: + # Exclude python from the group on purpose. Dependabot's Docker + # pre-release filter is bypassed for *grouped* updates + # (dependabot-core#9496), so a grouped python update proposes pre-release + # tags like python:3.15.0b2 as if they were a normal stable minor bump. + # Updated individually, python is filtered correctly: alpha/beta/rc tags + # are skipped and only stable releases (e.g. 3.15.0 once final) are + # proposed. node + uv stay grouped into a single digest PR. patterns: ["*"] + exclude-patterns: ["python"] ignore: # Node.js: block major-version bumps so dependabot never proposes # moving from one LTS line to a non-LTS "Current" release (e.g. 24 -> 25).