From e4eaab16d0ef9890b2b927aaeb6568a8afca6245 Mon Sep 17 00:00:00 2001
From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com>
Date: Fri, 2 Oct 2026 20:22:37 -0700
Subject: [PATCH] chore(dependabot): monthly grouped version updates

---
 .github/dependabot.yml | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d7e365a..34820aa 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,13 +1,22 @@
-# Dependency updates target dev; they reach main only through a release.
+# Version updates are monthly and grouped into one PR per ecosystem.
+# Security updates are separate and run whenever an advisory is published.
 version: 2
 updates:
-  - package-ecosystem: "pip"
-    directory: "/"
-    target-branch: "dev"
-    schedule:
-      interval: "weekly"
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    target-branch: "dev"
-    schedule:
-      interval: "weekly"
+- package-ecosystem: pip
+  directory: /
+  target-branch: dev
+  schedule:
+    interval: monthly
+  groups:
+    all:
+      patterns:
+      - '*'
+- package-ecosystem: github-actions
+  directory: /
+  target-branch: dev
+  schedule:
+    interval: monthly
+  groups:
+    all:
+      patterns:
+      - '*'