From 94ee90949340b97e497e9275a91d60460249765b Mon Sep 17 00:00:00 2001
From: Jan Calanog <jan.calanog@elastic.co>
Date: Mon, 20 Jul 2026 21:40:56 +0200
Subject: [PATCH 1/2] Group Dependabot updates by risk

Reduce update noise while preserving isolated major upgrades and compatibility-sensitive dependency families.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/dependabot.yml | 67 ++++++++++++++++++++++++++++++++++++------
 1 file changed, 58 insertions(+), 9 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e6d07e35ed..80cd2f1e14 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,10 +7,34 @@ updates:
       interval: 'weekly'
       day: 'monday'
       time: '08:00'
+    groups:
+      # Batch routine updates, but keep unrelated major upgrades isolated.
+      github-actions-security:
+        applies-to: security-updates
+        patterns:
+          - '*'
+      github-actions-minor-patch:
+        applies-to: version-updates
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'
+      github-actions-major-by-dependency:
+        applies-to: version-updates
+        group-by: dependency-name
+        update-types:
+          - 'major'
     labels:
       - chore
     cooldown:
       default-days: 14
+    # Elastic actions intentionally use floating major tags such as @v1.
+    ignore:
+      - dependency-name: 'elastic/*'
+        update-types:
+          - 'version-update:semver-minor'
+          - 'version-update:semver-patch'
   - package-ecosystem: npm
     directories:
       - '**/*'
@@ -21,19 +45,32 @@ updates:
       day: 'monday'
       time: '08:00'
     groups:
-      eslint:
-        patterns:
-          - 'eslint'
-          - '@eslint/*'
-          - 'typescript-eslint'
-      eui:
-        patterns:
-          - '@elastic/eui*'
+      # Keep the Tailwind toolchain compatible across dependency types.
       tailwindcss:
         patterns:
           - 'tailwindcss'
           - '@tailwindcss/postcss'
           - 'prettier-plugin-tailwindcss'
+      npm-security:
+        applies-to: security-updates
+        patterns:
+          - '*'
+      npm-development-minor-patch:
+        applies-to: version-updates
+        dependency-type: development
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'
+      npm-production-minor-patch:
+        applies-to: version-updates
+        dependency-type: production
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'
     labels:
       - chore
   - package-ecosystem: nuget
@@ -42,11 +79,23 @@ updates:
       interval: 'weekly'
       day: 'monday'
       time: '08:00'
-    groups: 
+    groups:
+      # The core package and testing helpers must update together.
       system-io-abstractions:
         patterns:
           - 'System.IO.Abstractions'
           - 'System.IO.Abstractions.*'
+      nuget-security:
+        applies-to: security-updates
+        patterns:
+          - '*'
+      nuget-minor-patch:
+        applies-to: version-updates
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'
     labels:
       - chore
     cooldown:

From edc6f442959f84892638b7b536da2e761aff356c Mon Sep 17 00:00:00 2001
From: Jan Calanog <jan.calanog@elastic.co>
Date: Mon, 20 Jul 2026 21:46:21 +0200
Subject: [PATCH 2/2] Preserve existing npm dependency groups

Keep established compatibility groupings ahead of the new catch-all update batches.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/dependabot.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 80cd2f1e14..470ca8f42c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -45,6 +45,14 @@ updates:
       day: 'monday'
       time: '08:00'
     groups:
+      eslint:
+        patterns:
+          - 'eslint'
+          - '@eslint/*'
+          - 'typescript-eslint'
+      eui:
+        patterns:
+          - '@elastic/eui*'
       # Keep the Tailwind toolchain compatible across dependency types.
       tailwindcss:
         patterns: