From 6011606ddfd190f994ae65406c4fd983dbf4a172 Mon Sep 17 00:00:00 2001
From: Carolina <79524656+carochacs@users.noreply.github.com>
Date: Tue, 29 Sep 2026 22:37:22 -0600
Subject: [PATCH 1/2] chore: configure grouped Dependabot updates

---
 .github/dependabot.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c99d404
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+# Group minor/patch version updates to limit PR noise.
+# Preserve existing schedules and major-version restrictions; no auto-merge.
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: monthly
+  open-pull-requests-limit: 5
+  groups:
+    minor-and-patch:
+      patterns:
+      - '*'
+      update-types:
+      - minor
+      - patch

From 8dc2d77d70a3d9331c1b74b0e228e54c8cf8d90c Mon Sep 17 00:00:00 2001
From: Carolina <79524656+carochacs@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:07:56 -0600
Subject: [PATCH 2/2] chore: address Dependabot review findings

---
 .github/dependabot.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c99d404..85efe36 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,5 +1,6 @@
 # Group minor/patch version updates to limit PR noise.
-# Preserve existing schedules and major-version restrictions; no auto-merge.
+# Monthly checks; major updates remain outside the minor/patch groups.
+# Groups apply to version updates, not security updates or automatic merging.
 version: 2
 updates:
 - package-ecosystem: github-actions