chore: ignore Dependabot patch releases

[senamakel]

Ignore semver patch updates for every configured ecosystem. Minor and major updates remain eligible, and security updates are unaffected.

Summary by CodeRabbit

• Chores
  • Configured automated dependency updates to skip patch-level updates for Cargo and GitHub Actions dependencies.
  • Minor and major dependency updates will continue to be considered.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 373d759b-18c0-496c-a5ee-1813bc1d22c5

📥 Commits

Reviewing files that changed from the base of the PR and between 54fe830 and 1142af2.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Dependabot configuration now ignores patch-level updates for all Cargo dependencies and GitHub Actions. Minor and major updates remain enabled.

Changes

Dependabot update policy

Layer / File(s)	Summary
Patch update filters .github/dependabot.yml	Adds rules that ignore version-update:semver-patch updates for the cargo and github-actions ecosystems.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuring Dependabot to ignore patch releases.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

_{A rabbit checks the update queue
Patch-sized hops are skipped from view
Minor leaps remain in flight
Major carrots still shine bright
Cargo and Actions rest tonight}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T17:30:36.701166Z	1142af2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tinysweeper]

Tiny Sweeper review

This pull request adds ignore rules to Dependabot configuration to suppress all patch-level updates for both Cargo dependencies and GitHub Actions. Reviewers have conflicting opinions: the critique and security lanes consider it unsafe because security fixes are often patch releases and would be suppressed, while the description lane considers it safe to merge, noting that minor and major updates remain eligible and security updates can be handled separately. The change is purely configuration.

State: Changes requested
Priority: high
Reviewed head: 1142af252a15
Updated: 1789839321 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	3
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

Modified `.github/dependabot.yml` to add `ignore` entries under both Cargo and GitHub Actions update configurations, specifying `update-types: ["version-update:semver-patch"]` for all dependency names.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

• high · critique · Do not suppress all patch-level dependency updates — This wildcard ignore applies to every Cargo dependency in the root update configuration, preventing Dependabot from opening patch updates that may contain bug fixes or security fix (\.github/dependabot\.yml:7)
• high · critique · Keep patch updates enabled for GitHub Actions — This wildcard ignore also suppresses patch updates for every GitHub Action, including updates that may repair action bugs or address security issues without changing the major or m (\.github/dependabot\.yml:7)
• medium · security · Do not suppress all patch updates — This wildcard ignore applies to every dependency in the Cargo update configuration, and the same block is added to the GitHub Actions configuration. Security fixes are frequently r (\.github/dependabot\.yml:7)

Before merge

• Address Do not suppress all patch-level dependency updates (\.github/dependabot\.yml).
• Address Keep patch updates enabled for GitHub Actions (\.github/dependabot\.yml).

Agent review details

critique

• Conclusion: Failure
• Scope reviewed: all assigned evidence
• Lane summary: The change suppresses all patch-level Cargo and GitHub Actions updates, so routine bug fixes and potentially security fixes will no longer be proposed automatically. This is not safe to merge unless intentionally accepting stale patch versions. (1 observation(s) grouped into shared inline comments) _The code index is behind this pull request (indexed at `f12d7e3d94af`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/dependabot\.yml — Do not suppress all patch-level dependency updates
• Evidence: \.github/dependabot\.yml — Keep patch updates enabled for GitHub Actions

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change globally suppresses Dependabot patch updates for both Cargo dependencies and GitHub Actions. This is not safe to merge because security fixes are commonly shipped as patch releases and will no longer be proposed automatically. (1 observation(s) grouped into shared inline comments) _The code index is behind this pull request (indexed at `f12d7e3d94af`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/dependabot\.yml — Do not suppress all patch updates

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds Dependabot ignore rules to skip patch updates for Cargo and GitHub Actions, keeping minor and major updates and security updates eligible. Safe to merge. _The code index is behind this pull request (indexed at `f12d7e3d94af`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.002844
• Tokens: 55447 input · 5645 output · 7876 cached · 34 embedding

Head	State	Pass summary
1142af252a15	changes requested	3 active finding(s), 0 resolved finding(s) (at 1789839321)

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0028 · 55,447 in / 5,645 out · 7,876 cached (14%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 34 embedded
critique:    $0.0018 · 32,454 in / 2,856 out · 4,560 cached (14%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0009 · 14,978 in / 720 out   · 1,780 cached (12%) · gpt-5.6-luna
description: $0.0001 · 6,443 in  / 983 out   · 1,536 cached (24%) · deepseek-v4-flash

[tinysweeper]

Do not suppress all patch-level dependency updates

This wildcard ignore applies to every Cargo dependency in the root update configuration, preventing Dependabot from opening patch updates that may contain bug fixes or security fixes. It also contradicts the following cargo-minor-and-patch group, whose stated purpose is to propose routine compatible patch updates. Remove this ignore or restrict it to explicitly approved dependencies; otherwise the repository can remain indefinitely on vulnerable or broken patch releases.

---

Additional security observation

Do not suppress all patch updates

[RULE] ignored-security-updates

This wildcard ignore applies to every dependency in the Cargo update configuration, and the same block is added to the GitHub Actions configuration. Security fixes are frequently released as semver patch versions, so this prevents Dependabot from opening updates that remediate vulnerabilities and leaves the repository dependent on manual detection and upgrades. Restrict the ignore rule to specific noisy dependencies, or remove it and handle unwanted updates individually.

---

Additional critique observation

Keep patch updates enabled for GitHub Actions

[RULE] ignored-dependency-updates

This wildcard ignore also suppresses patch updates for every GitHub Action, including updates that may repair action bugs or address security issues without changing the major or minor version. Since the workflow relies on third-party actions, disabling all patch proposals weakens the repository's update and supply-chain maintenance. Remove this ignore or enumerate only dependencies that are deliberately pinned.

[RULE] ignored-dependency-updates ·