From 96418e4d948e33d8f308e2a7ace4a1563a7a78b3 Mon Sep 17 00:00:00 2001
From: philippe <t4rk@outlook.com>
Date: Tue, 22 Sep 2026 12:57:17 -0400
Subject: [PATCH 1/2] Group @plotly workspace packages into one Dependabot job

The /@plotly/* packages had no Dependabot entry, so the root "/" entry's
recursion opened an individual, ungrouped PR per dependency for each one.
Add a dedicated npm entry using a directories glob so all /@plotly/*
manifests fold into a single grouped PR, matching the components and
renderer. Carries the same ignore pins (react-docgen, @babel/* <8,
babel-loader <10, typescript <6) plus react/react-dom <17 for the test
fixtures.
---
 .github/dependabot.yml | 54 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 48 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d0420a95d2..768ebdb297 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,12 +4,12 @@ updates:
   # NOTE: Dependabot's npm updater recurses from "/" into every nested
   # package.json, and neither the singular `directory` nor plural `directories`
   # with `!` exclusion globs stops that recursion. So the ONLY reliable way to
-  # keep this entry from bumping the components/renderer (which carry their own
-  # narrow allow/ignore lists, e.g. react-docgen is pinned) is the `allow` list
-  # below: it names only packages that exist SOLELY in the root package.json, so
-  # even while recursing, Dependabot opens root-only PRs. npm-run-all, rimraf and
-  # @types/jest are intentionally omitted — they also live in the components and
-  # would produce duplicate PRs.
+  # keep this entry from bumping the components/renderer/@plotly packages (which
+  # each carry their own narrow allow/ignore lists, e.g. react-docgen is pinned)
+  # is the `allow` list below: it names only packages that exist SOLELY in the
+  # root package.json, so even while recursing, Dependabot opens root-only PRs.
+  # npm-run-all, rimraf and @types/jest are intentionally omitted: they also live
+  # in the components and would produce duplicate PRs.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
@@ -194,6 +194,48 @@ updates:
       - dependency-name: "babel-loader"
         versions: [">=10.0.0"]
 
+  # @plotly workspace packages (build helpers, jupyterlab, and the generator /
+  # test-component fixtures). These have no per-package config, so without this
+  # entry Dependabot's root "/" recursion opens an individual, ungrouped PR for
+  # each one. The `directories` glob claims every /@plotly/* manifest and folds
+  # them into a single grouped PR.
+  - package-ecosystem: "npm"
+    directories:
+      - "/@plotly/*"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    cooldown:
+      default-days: 14
+    groups:
+      npm-dependencies:
+        applies-to: version-updates
+        patterns:
+          - "*"
+      npm-dependencies-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+    # react-docgen is pinned for legacy metadata extraction (extract-meta.js uses
+    # the react-docgen 5 API) and must never be updated.
+    ignore:
+      - dependency-name: "react-docgen"
+      # The test/generator fixtures pin React 16 (react-jsx-parser peer-deps on
+      # 16/17); a major bump breaks them. Stay on 16.x.
+      - dependency-name: "react"
+        versions: [">=17.0.0"]
+      - dependency-name: "react-dom"
+        versions: [">=17.0.0"]
+      # typescript 6+ (and the native tsc 7) break the type-check. Stay on 5.x.
+      - dependency-name: "typescript"
+        versions: [">=6.0.0"]
+      # Babel 8 / babel-loader 10 break the build (the class-properties plugin
+      # peer-deps on @babel/core ^7). Stay on the 7.x / 9.x line.
+      - dependency-name: "@babel/*"
+        versions: [">=8.0.0"]
+      - dependency-name: "babel-loader"
+        versions: [">=10.0.0"]
+
   # Python dependencies
   - package-ecosystem: "pip"
     directory: "/"

From abe3d370dcc22e280c0ed7ab995691bc8182cbe6 Mon Sep 17 00:00:00 2001
From: Philippe Duval <t4rk@outlook.com>
Date: Tue, 22 Sep 2026 15:17:55 -0400
Subject: [PATCH 2/2] Update .github/dependabot.yml

Co-authored-by: Cameron DeCoster <cameron.decoster@gmail.com>
---
 .github/dependabot.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 768ebdb297..7ec562e55c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -216,9 +216,9 @@ updates:
         applies-to: security-updates
         patterns:
           - "*"
-    # react-docgen is pinned for legacy metadata extraction (extract-meta.js uses
-    # the react-docgen 5 API) and must never be updated.
     ignore:
+      # react-docgen is pinned for legacy metadata extraction (extract-meta.js uses
+      # the react-docgen 5 API) and must never be updated.
       - dependency-name: "react-docgen"
       # The test/generator fixtures pin React 16 (react-jsx-parser peer-deps on
       # 16/17); a major bump breaks them. Stay on 16.x.