chore: ignore Dependabot patch releases

[senamakel]

Ignore semver patch updates for every configured ecosystem. Minor and major updates remain eligible, and security updates are unaffected.

Summary by CodeRabbit

• Chores
  • Dependabot will no longer automatically propose semver-patch updates for Cargo dependencies or GitHub Actions.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T17:31:06.125216Z	bca2d71	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 3af7aade-c8a4-4da1-8372-1e5f299eff36

📥 Commits

Reviewing files that changed from the base of the PR and between 8d116fc and bca2d71.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependabot now ignores semver patch updates for all Cargo and GitHub Actions dependencies.

Changes

Dependabot Update Policy

Layer / File(s)	Summary
Patch update filters .github/dependabot.yml	The Cargo and GitHub Actions configurations now ignore version-update:semver-patch updates for all dependencies.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuring Dependabot to ignore patch releases.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{A rabbit checks the update trail
Patch-sized hops now miss the gate
Cargo rests beneath the moon
Actions wait for larger tunes
The config keeps a steady pace}

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 2 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: medium
Reviewed head: bca2d7154647
Updated: 1789840173 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	2
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

• medium · critique · Do not suppress all routine patch updates — This ignores every semver-patch update for the entire Cargo and GitHub Actions ecosystems. As a result, the existing `cargo-minor-and-patch` group can no longer receive Cargo patch (\.github/dependabot\.yml:7)
• medium · security · Continue proposing patch dependency updates — Ignoring every patch update for every dependency prevents routine fixes from being proposed, including security fixes delivered as patch releases and fixes to GitHub Actions. Altho (\.github/dependabot\.yml:7)

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change suppresses all semver-patch Dependabot updates for both Cargo and GitHub Actions. This is internally inconsistent with the existing grouping configuration and leaves routine patch updates unapplied, so it should not merge without confirming that this suppression is intentional. _The code index is behind this pull request (indexed at `1732910b3d77`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/dependabot\.yml — Do not suppress all routine patch updates

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change suppresses all semver-patch Dependabot updates for both Cargo dependencies and GitHub Actions. This can leave security and reliability fixes undiscovered, so it is not safe to merge unchanged. (1 observation(s) grouped into shared inline comments) _The code index is behind this pull request (indexed at `1732910b3d77`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/dependabot\.yml — Continue proposing patch dependency updates

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds `ignore` blocks to Dependabot config to suppress semver-patch update PRs for both Cargo and GitHub Actions, while leaving minor, major, and security updates unaffected. The change is correct and matches the stated intent. _The code index is behind this pull request (indexed at `1732910b3d77`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: flash, ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.002704
• Tokens: 54198 input · 5794 output · 7876 cached · 34 embedding

Head	State	Pass summary
bca2d7154647	ready for maintainer review	2 active finding(s), 0 resolved finding(s) (at 1789840173)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0027 · 54,198 in / 5,794 out · 7,876 cached (15%) · flash, ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 34 embedded
critique:    $0.0016 · 30,931 in / 1,497 out · 5,072 cached (16%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0008 · 14,260 in / 725 out   · 1,780 cached (12%) · gpt-5.6-luna
description: $0.0001 · 6,202 in  / 377 out   · 1,024 cached (17%) · deepseek-v4-flash

[tinysweeper]

Do not suppress all routine patch updates

This ignores every semver-patch update for the entire Cargo and GitHub Actions ecosystems. As a result, the existing cargo-minor-and-patch group can no longer receive Cargo patch updates, and weekly patch fixes—including dependency bug and security fixes delivered as patch releases—will not be proposed as normal update PRs. Remove this ignore rule or narrow it to specific dependencies whose patch updates are intentionally deferred.

---

Additional security observation

Continue proposing patch dependency updates

[RULE] ignored-security-updates

Ignoring every patch update for every dependency prevents routine fixes from being proposed, including security fixes delivered as patch releases and fixes to GitHub Actions. Although Dependabot may separately raise some alert-driven security updates, this blanket suppression creates an avoidable gap in maintenance and can leave vulnerable or broken versions in use. Remove the wildcard patch ignore (in both update blocks), or narrowly document and scope any dependency-specific exceptions.

[RULE] disabled-updates ·