Group Dependabot updates into a single update block#2571
Open
joperezr wants to merge 6 commits into
Open
Conversation
Replace the 17 per-directory update blocks with a single block that uses the directories: (plural) field and 5 groups (arcade, dotnet-runtime, xunit, skiasharp, and an other-minor-patch catch-all). Major bumps stay ungrouped so breaking changes get individual review. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replaces the explicit (and incomplete) directory list with globs: /samples/*, /src/devices/*/tests, /src/devices/*/samples. This auto-tracks new device/sample projects instead of requiring manual updates to dependabot.yml. Scope expansion: samples 5 -> 10, device tests 8 -> 27, device samples 1 -> ~120. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replace the curated directory globs with a single recursive /** entry and a negated /eng/common/** exclusion. The previous lists were incomplete and dropping new projects was a latent bug. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Arcade (Microsoft.DotNet.*) is updated via the arcade flow, not Dependabot. Everything else (minor/patch) is bundled into one all-dependencies group per week; majors still fall out as individual PRs for breaking-change review. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
With one group + arcade ignored, the expected steady state is 1 grouped PR per week plus the occasional major. 10 was leftover from when we had 5 separate groups; 5 (the original value) is plenty. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
System.* and Microsoft.Extensions.* ship on the .NET release train, so a major bump (e.g. 9.x -> 10.x) lands across all of them at the same time and is best reviewed as a single PR. Move them into a dedicated dotnet-runtime group with no update-types restriction; the all-dependencies catch-all stays minor/patch-only for everything else. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
raffaeler
approved these changes
Jun 11, 2026
pgrawehr
approved these changes
Jun 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the 17 per-directory
nugetupdate blocks in.github/dependabot.ymlwith a single update block that uses thedirectories:(plural) field and bundles related package updates into grouped PRs.Motivation
Looking at Dependabot activity from the last ~7 weeks, the repo was getting 7–10 PRs per Wednesday, mostly from the same families of packages bumping together (e.g.
Microsoft.DotNet.Arcade.Sdk+Helix.Sdk+GenAPIevery week, and theSystem.*/Microsoft.Extensions.*packages every .NET monthly release).Grouping strategy
arcadeMicrosoft.DotNet.*,Microsoft.Build.Traversaldotnet-runtimeSystem.*,Microsoft.Extensions.*xunitxunit,xunit.*skiasharpSkiaSharp,SkiaSharp.*other-minor-patch*minus the aboveUnitsNet,Microsoft.CodeAnalysis.*)Major bumps are intentionally excluded from the groups (only
minor/patchare grouped). Majors will still get individual PRs so breaking changes can be reviewed in isolation — matching the pattern we already follow when closing things like theSkiaSharp 2.x → 3.xjump.Expected outcome
open-pull-requests-limitraised from5to10to leave headroom for ungrouped majors arriving alongside the groups.Notes
/src/devices/*/tests) could be a follow-up if desired.groupsdocsMicrosoft Reviewers: Open in CodeFlow