[lhoupert]

Dependabot opens one PR per security advisory (#1534, #1536–#1540), while version updates arrive as the single all group (#1543): a group without applies-to "defaults to version updates" (options reference). This adds a security group for uv, and groups the Docker updates, which also came as separate PRs (#1529, #1541). Same grouping as EOPF-Explorer/titiler-eopf's Dependabot config.

For reviewers: the open security PRs stay as they are. #1536 and #1537 are already on main via #1543, and #1538 is superseded by #1540.

How this was made

Claude Code traced the single-package PRs to security updates (each carries Dependabot's security footer and matches an advisory from 20–23 Oct) and took the two groups from EOPF-Explorer/titiler-eopf's config. The file validates against the Dependabot schema (check-jsonschema --builtin-schema vendor.dependabot), which also rejects a mistyped applies-to. @lhoupert asked for this PR. The grouping itself can only be observed once Dependabot runs on main.

— Claude Code, on behalf of @lhoupert

[Copilot]

🟢 Approval recommended

It is a small, schema-valid Dependabot config change that correctly groups uv security updates and Docker image bumps with no identifiable issues.

No open issues 🎉

What changed in this PR

This PR refines .github/dependabot.yml to reduce PR noise from Dependabot. Previously, security advisories for uv-managed dependencies each opened their own PR (since the existing all group only applies to version updates), and Docker image bumps also arrived as separate PRs. The change adds a dedicated security group for the uv ecosystem and a grouping block for the Docker ecosystem, mirroring the configuration used in EOPF-Explorer/titiler-eopf.

Changes:

• Add a security group (applies-to: security-updates, patterns *) to the uv ecosystem so security advisories are grouped into one PR.
• Add a groups.all block (patterns *) to the Docker ecosystem so image bumps are grouped.
• Document, via a comment, why the extra security group is needed alongside the existing all group.

File	Description
.github/​dependabot.yml	Adds a security group for uv security updates and an all grouping block for Docker image bumps, with a clarifying comment.

_{Review effort: Balanced}