chore: ignore Dependabot patch releases

[senamakel]

Ignore semver patch updates for every configured ecosystem. Minor and major updates remain eligible, and security updates are unaffected.

Summary by CodeRabbit

• Chores
  • Updated automated dependency update settings to skip semver patch updates for Rust and GitHub Actions dependencies.
  • Weekly dependency checks and a limit of five open update pull requests remain enabled.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 7a83035b-04db-4526-bfa2-834def75d89e

📥 Commits

Reviewing files that changed from the base of the PR and between ec34c08 and 0a32fb4.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependabot now ignores patch-level updates for Cargo and GitHub Actions dependencies. Weekly checks and the limit of five open pull requests remain unchanged.

Changes

Dependabot update filters

Layer / File(s)	Summary
Ignore patch updates .github/dependabot.yml	Cargo and GitHub Actions configurations ignore patch-level dependency updates. Existing weekly scheduling and open pull request limits remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuring Dependabot to ignore patch releases.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{A rabbit checks the weekly queue
Patch updates wait in a quiet row
Cargo hops past tiny changes
Actions rest beneath moonlit ranges
Five bright pulls remain in view}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T17:29:50.824242Z	0a32fb4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

Tiny Sweeper review

This pull request modifies the Dependabot configuration to ignore all patch version updates for both the 'cargo' and 'github-actions' ecosystems. Weekly schedules and pull-request limits remain unchanged. This reduces noise from patch-level updates while still allowing major and minor updates to be proposed.

State: Ready for maintainer review
Priority: none
Reviewed head: 0a32fb461a89
Updated: 1789839762 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

Added `ignore` blocks for both `cargo` and `github-actions` package ecosystems in `.github/dependabot.yml`, which suppress Dependabot PRs for semver-patch updates. The existing schedule (`weekly`) and `open-pull-requests-limit: 5` are preserved.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The configuration validly suppresses semver-patch Dependabot updates for both Cargo and GitHub Actions while retaining weekly checks and pull-request limits. No correctness issue is evident, so this change is safe to merge. _The code index for this repository is cold, so this review saw the diff alone._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The Dependabot configuration now ignores all patch updates for Cargo and GitHub Actions dependencies. This reduces maintenance and can delay important fixes, but no directly exploitable security issue is evident from this change. _The code index for this repository is cold, so this review saw the diff alone._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This change adds an `ignore` block to Dependabot configuration for both cargo and GitHub Actions ecosystems to skip semver patch updates, aligning with the stated intent. The diff matches the description and introduces no defects. _The code index for this repository is cold, so this review saw the diff alone._ _2 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.001588
• Tokens: 34877 input · 2341 output · 8632 cached · 0 embedding

Head	State	Pass summary
0a32fb461a89	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 1789839762)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0016 · 34,877 in / 2,341 out · 8,632 cached (25%) · gpt-5.6-luna, deepseek-v4-flash
critique:    $0.0007 · 13,883 in / 587 out   · 4,048 cached (29%) · gpt-5.6-luna
security:    $0.0007 · 13,395 in / 785 out   · 3,560 cached (27%) · gpt-5.6-luna
description: $0.0001 · 6,201 in  / 155 out   · 1,024 cached (17%) · deepseek-v4-flash