Consolidate Dependabot updates and reduce PR noise

.github/dependabot.yml

@@ -1,29 +1,49 @@
 version: 2
+# Explicit target branches keep these version-update rules separate from
+# Dependabot security updates, which continue on the repository default branch.
 updates:
   - package-ecosystem: npm
     directory: /
+    target-branch: main
     schedule:
       interval: weekly
     groups:
       npm-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
         update-types:
           - minor
           - patch
-    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+    open-pull-requests-limit: 3
 
   - package-ecosystem: cargo
     directory: /src-tauri
+    target-branch: main
     schedule:
       interval: weekly
     groups:
       cargo-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
         update-types:
           - minor
           - patch
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 3
 
   - package-ecosystem: github-actions
     directory: /
+    target-branch: main
     schedule:
       interval: weekly
-    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        applies-to: version-updates
+        patterns:
+          - "*"
+    open-pull-requests-limit: 3

.github/workflows/ci.yml

@@ -110,7 +110,7 @@ jobs:
 
       - name: Upload x86_64 Debian package for installed-app E2E
         if: matrix.platform == 'ubuntu-22.04'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: annotation-studio-linux-deb
           path: src-tauri/target/release/bundle/deb/*.deb
@@ -194,7 +194,7 @@ jobs:
         run: cargo install tauri-driver --locked
 
       - name: Download the normal production Debian package
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: annotation-studio-linux-deb
           path: ${{ runner.temp }}/annotation-studio-linux-deb

.github/workflows/pages.yml

@@ -32,7 +32,7 @@ jobs:
         run: npx playwright-cli install-browser chromium --with-deps --only-shell
       - name: Verify serverless workflow
         run: npm run test:static-pages
-      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: dist-pages
 
@@ -47,7 +47,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
       - name: Publish
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1