ci: switch dependabot to biweekly patch-only updates

[dev-jodee]

Summary

• Switch schedule from weekly to cron: 1st and 15th of the month, 09:00 UTC
• Restrict version updates to semver-patch via allow — majors and minors no longer open PRs
• Combine all ecosystems into a single PR via multi-ecosystem-groups
• Remove the ignore semver-patch rule, which also suppressed patch-level security PRs — security updates now always come through at any severity and bump level

Test Plan

• YAML validated locally
• After merge: check Insights → Dependency graph → Dependabot for config parse errors

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
solana-rewards-program	Ready	Preview, Comment	Jul 9, 2026 12:49pm

[greptile-apps]

Greptile Summary

This PR reconfigures Dependabot to run on a biweekly cron schedule (1st and 15th at 09:00 UTC), restricts version updates to semver-patch only via allow, and consolidates all three ecosystems (cargo, npm, github-actions) into a single PR using the new multi-ecosystem-groups feature. It also removes the old ignore patch rule, which was unintentionally suppressing security patch PRs.

• Schedule & allow: Weekly cadence replaced with a biweekly cron; ignore blocks swapped for allow with version-update:semver-patch, so only patch bumps open PRs and security updates flow through unrestricted.
• Multi-ecosystem grouping: All three ecosystems are assigned to the all-deps group so updates land in one combined PR; however, the retained cooldown: default-days: 7 per ecosystem is a known incompatibility that prevents proper aggregation (see inline comment).
• Removed per-ecosystem groups: The old cargo-non-major, npm-non-major, and actions single-ecosystem groups are dropped in favour of the top-level multi-ecosystem group.

Confidence Score: 4/5

The config change is safe to merge but multi-ecosystem grouping will not work as intended until the per-ecosystem cooldown blocks are removed.

The cooldown entries on each ecosystem update contradict the multi-ecosystem-groups goal: only one ecosystem will batch per cooldown window instead of all three combining into a single PR. The rest of the change is correct and well-formed.

.github/dependabot.yml — the three cooldown blocks need to be removed for multi-ecosystem grouping to function correctly.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Switches to biweekly cron, patch-only allow, and multi-ecosystem grouping — but per-ecosystem cooldown: default-days: 7 is a known incompatibility that prevents all three ecosystems from being batched into a single PR as intended.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["Biweekly cron trigger\n1st & 15th, 09:00 UTC"] --> B["Dependabot checks ecosystems"]
    B --> C["cargo patches"]
    B --> D["npm patches"]
    B --> E["github-actions patches"]
    C --> F{"cooldown\ndefault-days: 7\n⚠️ known incompatibility"}
    D --> F
    E --> F
    F -->|"Expected (intended)"| G["Single combined PR\nall-deps group"]
    F -->|"Actual (bug)"| H["One ecosystem PR\nevery 7 days only"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["Biweekly cron trigger\n1st & 15th, 09:00 UTC"] --> B["Dependabot checks ecosystems"]
    B --> C["cargo patches"]
    B --> D["npm patches"]
    B --> E["github-actions patches"]
    C --> F{"cooldown\ndefault-days: 7\n⚠️ known incompatibility"}
    D --> F
    E --> F
    F -->|"Expected (intended)"| G["Single combined PR\nall-deps group"]
    F -->|"Actual (bug)"| H["One ecosystem PR\nevery 7 days only"]

Loading

_{Reviews (3): Last reviewed commit: "ci: move open-pull-requests-limit to mul..." | Re-trigger Greptile}

[github-actions]

Compute Unit Report

Instruction	Samples	CUs	Est Cost (Low) [SOL]	Est Cost (Med) [SOL]	Est Cost (High) [SOL]	Δ Avg vs main
AddDirectRecipient	74	10891	0.000005003	0.000005435	0.000010445
ClaimDirect	27	9671	0.000005002	0.000005386	0.000009835
ClaimMerkle	24	108812	0.000005032	0.000009352	0.000059406
CloseDirectDistribution	7	6548	0.000005001	0.000005261	0.000008274
CloseDirectRecipient	6	3526	0.000005001	0.000005141	0.000006763
CloseMerkleClaim	3	4545	0.000005001	0.000005181	0.000007272
CloseMerkleDistribution	15	7921	0.000005002	0.000005316	0.000008960
CreateDirectDistribution	103	12811	0.000005003	0.000005512	0.000011405
CreateMerkleDistribution	91	14394	0.000005004	0.000005575	0.000012197
RevokeDirectRecipient	12	10632	0.000005003	0.000005425	0.000010316
RevokeMerkleClaim	15	110086	0.000005033	0.000009403	0.000060043

🔺 increase · 🔻 decrease · – unchanged · 🆕 new · 🗑 removed (vs main)

Generated: 2026-07-09