From c0d7079e8838558a0785108a07147b7496717831 Mon Sep 17 00:00:00 2001
From: cucadmuh <49571317+cucadmuh@users.noreply.github.com>
Date: Fri, 29 May 2026 23:19:18 +0300
Subject: [PATCH] chore(deps): restrict Dependabot to security updates only
 (#918)

Disable scheduled version-update PRs (open-pull-requests-limit: 0). Keep
grouped security PRs per ecosystem; symphonia migration ignores unchanged.
---
 .github/dependabot.yml | 25 +++++++++++++++++++++----
 SECURITY.md            |  2 +-
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 87f8e771..fb32ffaa 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,5 +1,10 @@
-# Weekly dependency update PRs for npm (frontend) and Cargo (src-tauri workspace).
-# Review and merge like any other PR; run CI before merging.
+# Dependabot: security updates only (no scheduled version bumps).
+#
+# Version updates are disabled via open-pull-requests-limit: 0. GitHub still opens
+# PRs when Dependabot/npm/cargo audit reports a vulnerability (and related
+# transitive fixes in the same bump). Routine minor/patch upgrades are manual.
+#
+# Requires "Dependabot security updates" enabled in repo Settings → Code security.
 
 version: 2
 updates:
@@ -8,18 +13,30 @@ updates:
     schedule:
       interval: weekly
       day: monday
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 0
     labels:
       - dependencies
+      - security
+    groups:
+      npm-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
 
   - package-ecosystem: cargo
     directory: /src-tauri
     schedule:
       interval: weekly
       day: monday
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 0
     labels:
       - dependencies
+      - security
+    groups:
+      cargo-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
     ignore:
       # Symphonia 0.6 is a coordinated migration (API break + isomp4 patch port).
       # See workdocs: internal/collaboration/tasks/2026-05-symphonia-0.6-migration/
diff --git a/SECURITY.md b/SECURITY.md
index 5da1c7f8..90b64604 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -25,4 +25,4 @@ Include what you can: affected version, platform (Windows / macOS / Linux), step
 
 ## Secure development
 
-Pull requests are reviewed on `main`. Dependency updates are tracked via Dependabot. For general contribution expectations, see [CONTRIBUTING.md](CONTRIBUTING.md).
+Pull requests are reviewed on `main`. **Dependency security updates** are tracked via Dependabot (PRs only for reported vulnerabilities and their fix paths—not routine version bumps). For general contribution expectations, see [CONTRIBUTING.md](CONTRIBUTING.md).