ci(dependabot): split major uv security updates out of the grouped PR
RE
5d ago+11+11+01234567890123456789-0-0-0123456789
Description
Right now Dependabot puts every uv security update into one PR ("bump the uv group across 1 directory"). If one bump in that PR fails CI, none of the others land. This happened in #445: it bumped pyasn1 0.6.3 → 0.6.4 AND setuptools 80.9.0 → 83.0.0. Since the setuptools major bump failed, we've also been blocked on the pyasn bump since July :(.
This diff splits minor security patches and major bumps. Minor patches still get grouped into a single PR since they're less likely to have CI issues, and more noisy/frequent. Major bumps get their own PR.
Notes
- A failing minor or patch fix can still hold back the others in its group. We could split it out too, but I think we should see if this is an issue vs the increased PR volume
- #445 stays as it is until Dependabot next runs, when it should be replaced. I also fixed pyasn1 in #562 if we want to go ahead manually
Testing
- The file parses as YAML, and the uv entry includes the new
groupskey. - Dependabot will validate
dependabot.ymlafter the merge. Any errors will show up on the Dependabot updates page.
Checklist
- Tests pass locally
- uv run ruff check . passes (no unused imports or other lint errors)
- uv tool run fawltydeps --check-unused --pyenv .venv passes (no unused dependencies)
- Updated CHANGELOG.md with my changes, if notable (refer to Keep a Changelog conventions)
Summary by CodeRabbit
- Chores
- Security updates accompanied by minor or patch updates are now grouped together. Major updates remain outside this group. This changes how these update notices are organized.