[hyperpolymath]

Adds open-pull-requests-limit to Dependabot update blocks that had no cap, following the estate per-ecosystem cap doctrine (task #37). No other line in the file is touched.

Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk

Summary

Changes

RSR Quality Checklist

Required

• Tests pass (just test or equivalent)
• Code is formatted (just fmt or equivalent)
• Linter is clean (no new warnings or errors)
• No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
• No unsafe blocks without // SAFETY: comments
• No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

As Applicable

• .machine_readable/STATE.a2ml updated (if project state changed)
• .machine_readable/ECOSYSTEM.a2ml updated (if integrations changed)
• .machine_readable/META.a2ml updated (if architectural decisions changed)
• Documentation updated for user-facing changes
• TOPOLOGY.md updated (if architecture changed)
• CHANGELOG or release notes updated
• New dependencies reviewed for license compatibility (MPL-2.0 / MPL-2.0)
• ABI/FFI changes validated (src/interface/abi/ and src/interface/ffi/ consistent)

Testing

Screenshots

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1ff27186-5cc6-4310-942f-961a2013b9d3

📥 Commits

Reviewing files that changed from the base of the PR and between e8404a6 and 75415c8.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (25)

• GitHub Check: rust-ci / Detect Cargo.toml
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Security policy checks
• GitHub Check: scan / gitleaks
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: scan / Hypatia Neurosymbolic Analysis
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Groove manifest check
• GitHub Check: Validate A2ML manifests
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: Validate K9 contracts
• GitHub Check: analyze (actions, none)
• GitHub Check: ABI ↔ FFI structural conformance
• GitHub Check: Zig FFI builds + tests (Zig 0.14.0)
• GitHub Check: panic-attack assail
• GitHub Check: Hypatia neurosymbolic scan
• GitHub Check: GitGuardian Security Checks

🔇 Additional comments (1)

.github/dependabot.yml (1)

16-16: LGTM!

Also applies to: 26-26, 41-41, 54-54, 67-67

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Limited the number of automated dependency update pull requests:
    • GitHub Actions: up to 2
    • npm, pip and mix: up to 3 each
    • Cargo: automated pull requests disabled

Walkthrough

Dependabot now limits open pull requests by ecosystem. Cargo updates are disabled. GitHub Actions, Mix, npm, and pip have limits of 2, 3, 3, and 3 respectively.

Changes

Dependabot pull request limits

Layer / File(s)	Summary
Configure ecosystem limits .github/dependabot.yml	The configuration limits GitHub Actions pull requests to 2, disables Cargo pull requests, and limits Mix, npm, and pip pull requests to 3 each.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to bb2e8

This change only adds the stated Dependabot pull-request limits and is ready to merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description states the intended change, but the required Summary and Changes sections are empty. The Testing section is also empty, and the checklist remains entirely unchecked.	Complete the Summary and Changes sections, describe the testing performed, and mark each applicable checklist item. Add testing output or state why testing is not applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: limiting open Dependabot pull requests per update block.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the update queue
Two hops for Actions, neat and true
Cargo rests beneath the moon
Mix, npm, pip stop at three soon
The burrow stays tidy and bright}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud