From effc0c353ca01e208b36fa40cedb1ecfc9f7d777 Mon Sep 17 00:00:00 2001
From: shenxianpeng <xianpeng.shen@gmail.com>
Date: Sun, 2 Aug 2026 12:46:33 +0300
Subject: [PATCH] chore: group dependabot updates per ecosystem including
 security updates

- npm / github-actions: keep existing version-update groups, add
  applies-to: security-updates groups so security bumps are also
  batched instead of one PR per dependency (e.g. #59-#61)
- add missing docker ecosystem (covers Dockerfile and Dockerfile.dev
  base images) with version-update and security-update groups
---
 .github/dependabot.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 901eefc..881af4d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,6 +10,10 @@ updates:
     npm-deps:
       patterns:
         - "*"
+    npm-deps-security:
+      applies-to: security-updates
+      patterns:
+        - "*"
 - package-ecosystem: github-actions
   directory: /
   schedule:
@@ -18,3 +22,19 @@ updates:
     github-action-deps:
       patterns:
         - "*"
+    github-action-deps-security:
+      applies-to: security-updates
+      patterns:
+        - "*"
+- package-ecosystem: docker
+  directory: /
+  schedule:
+    interval: quarterly
+  groups:
+    docker-deps:
+      patterns:
+        - "*"
+    docker-deps-security:
+      applies-to: security-updates
+      patterns:
+        - "*"