Every groups entry has an implicit applies-to: version-updates, which
means security advisories bypass the group config and open one PR per
affected package. The 11-PR backlog this week was driven by exactly
this: four /studio/src-tauri cargo advisories (rustls-webpki, tauri,
rand, openssl) opened individually instead of joining the cargo-tauri
group PR, and one /studio/frontend npm group PR (hono + ip-address)
opened outside the bun config because GitHub fires npm-package
advisories under the npm_and_yarn ecosystem regardless of which
package manager actually owns the lockfile.
Two changes:
1. Sibling groups with applies-to: security-updates for each existing
ecosystem (actions, bun, npm-oxc-validator, python, cargo-tauri).
Same patterns: ["*"] coverage, so security advisories batch into a
single PR per ecosystem per week alongside the version-update
group.
2. New npm entry pointed at /studio/frontend with
open-pull-requests-limit: 0 (suppress version-update PRs; bun
handles those) but with a security-updates group so future
hono-style advisories land in one batched PR instead of one PR
per package.
Doesn't retroactively regroup PRs already open; the existing 11 are
unaffected and merge as-is.
a6462876de