chore(deps): group dependency updates and run them nightly

[jan-kubica]

Dependency update PRs open daily at 03:00 (Europe/Prague), one grouped PR per ecosystem for minor and patch updates; majors stay separate.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T18:39:23.398110Z	786c50a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 22 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: stella/stdnum/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 9c6eaa2c-9072-49f6-a67a-0c8bd43d0ceb

📥 Commits

Reviewing files that changed from the base of the PR and between d603919 and b926c93.

📒 Files selected for processing (2)

• .github/dependabot.yml
• README.md

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: stella/stdnum/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: e6757c8d-908b-4f5f-872c-51bfac5acccd

📥 Commits

Reviewing files that changed from the base of the PR and between 188fa76 and d603919.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: cla / cla
• GitHub Check: Enforce package quarantine / Enforce package quarantine
• GitHub Check: trust-check
• GitHub Check: Check generated AI instructions
• GitHub Check: dependency-review

🔇 Additional comments (1)

.github/dependabot.yml (1)

8-9: LGTM!

Also applies to: 29-30, 53-54, 69-70, 85-86, 101-102

---

📝 Walkthrough

Walkthrough

The weekly update schedules for all six Dependabot ecosystems change from Saturday at 09:00 to Sunday at 04:00. The Europe/Prague timezone remains unchanged.

Changes

Dependabot schedules

Layer / File(s)	Summary
Update weekly schedules .github/dependabot.yml	The github-actions, bun, pip, bundler, composer and cargo schedules change to Sunday at 04:00. The timezone remains Europe/Prague.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to d6039

The requested schedule change is valid and consistent across all six ecosystems. No merge-blocking concern remains beyond normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to d6039

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/dependabot.yml: The github-actions weekly schedule changes from Saturday at 09:00 to Sunday at 04:00; the timezone remains Europe/Prague.
• observed — Modified behavior in .github/dependabot.yml: The bun weekly schedule changes from Saturday at 09:00 to Sunday at 04:00; the timezone remains Europe/Prague.
• observed — Modified behavior in .github/dependabot.yml: The pip weekly schedule changes from Saturday at 09:00 to Sunday at 04:00; the timezone remains Europe/Prague.
• observed — Modified behavior in .github/dependabot.yml: The bundler weekly schedule changes from Saturday at 09:00 to Sunday at 04:00; the timezone remains Europe/Prague.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies dependency updates and scheduling, which relates to the change. However, it incorrectly states that updates run nightly and mentions grouping, which the changes do not implement.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 786c50add6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".