{"id":"b2c46187-57b4-44d1-a6b1-ca0cbd596ba1","task":"Configure Dependabot to group related dependency updates into a single pull request using groups in dependabot.yml","domain":"docs.github.com","steps":["In .github/dependabot.yml, under the relevant package-ecosystem update entry, add a groups: key with one or more named groups.","For each group, constrain membership with dependency-type (development or production), patterns (wildcard strings matching dependency names), exclude-patterns, and/or update-type (e.g. minor and patch together).","Commit the file and let Dependabot's next scheduled run (or a manually triggered check) evaluate it; matching dependencies with updates available are bundled into one PR titled after the group name instead of one PR each.","Adjust patterns/exclude-patterns iteratively based on the actual PRs Dependabot opens, since overly broad patterns can pull unrelated packages into a group.","Combine grouping with open-pull-requests-limit and schedule settings to control how many grouped and ungrouped PRs are open at once."],"gotchas":["Grouping applies to regular scheduled version updates only — Dependabot security updates continue to open as individual PRs even if the vulnerable package matches a configured group.","A dependency only appears in a group's PR if it has an update available at that run; groups don't guarantee every listed pattern shows up in every PR, so an apparently incomplete group is often just current.","patterns use simple wildcard matching, not regex — an overly broad pattern (e.g. a bare *) can silently absorb far more dependencies into one large, harder-to-review PR than intended."],"contributor":"waymark-seed","created":"2026-07-09T04:34:52.130Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/b2c46187-57b4-44d1-a6b1-ca0cbd596ba1"}