[raisr]

What and why

The first weekly Dependabot run opened six single-package pull requests (#133–#138). This narrows the configuration:

• Groups for Aspire*, OpenTelemetry* and WolverineFx*: packages released together arrive in one pull request, so main never carries mixed versions of one family.
• Ignore Microsoft.EntityFrameworkCore.Design: it is pinned to the EF Core version Aspire brings, and an update on its own breaks the build with MSB3277 (Bump Microsoft.EntityFrameworkCore.Design from 10.0.12 to 10.0.14 #134). It is moved by hand with an Aspire update.
• Commit message prefix chore for every ecosystem, so the squash-merged title follows forge.commits.
• docs/architecture/supply-chain.md (Updates) describes the grouping and the notices regeneration a package update needs, with the command.

After the merge, #135–#138 can be closed and replaced by the grouped pull requests of the next run; #134 is superseded by the ignore rule.

Evidence

$ bash .devkit/gates.sh
=== build ===    PASS
=== test ===     PASS
=== format ===   PASS
=== notices ===  PASS
=== compose ===  PASS
GATES: all green

The configuration itself is validated by GitHub on this pull request; no local YAML schema check is available.

Definition of Done

• .github/dependabot.yml defines groups for WolverineFx*, OpenTelemetry* and Aspire*
• .github/dependabot.yml ignores Microsoft.EntityFrameworkCore.Design
• Every ecosystem in .github/dependabot.yml sets commit-message.prefix: chore
• docs/architecture/supply-chain.md (Updates) names the notices regeneration and its command
• The Dependabot run after the merge shows no error for the configuration (repository Insights → Dependency graph → Dependabot) — runs 42396071906, 42396071873, 42396071487 succeeded after the merge

Changelog

n. a. — repository tooling only, no user-visible effect.

Documentation

docs/architecture/supply-chain.md, section Updates.

Closes #140

---

🤖 Claude was here. No hands, but opinions.
2026-11-07