[WIP] Update Dependabot to create PRs for security vulnerabilities only

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

Original prompt

Problem

Currently, Dependabot is configured to create PRs for all dependency updates including breaking changes. This creates unnecessary noise and potential stability issues.

Solution

Update the .github/dependabot.yml configuration to only create PRs when security vulnerabilities are found in dependencies.

Changes Required

Update the .github/dependabot.yml file with the following changes:

1. Add open-pull-requests-limit: 10 to both the npm and github-actions package ecosystems to limit the number of open PRs
2. Add security-updates-only: true at the root level of the configuration to restrict updates to security vulnerabilities only

Here's the updated configuration:

version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
      day: 'sunday'
      time: '02:00'
      timezone: Europe/Berlin
    open-pull-requests-limit: 10
    groups:
      dependencies:
        dependency-type: production
        exclude-patterns:
          - 'puppeteer*'
        patterns:
          - '*'
      dev-dependencies:
        dependency-type: development
        exclude-patterns:
          - 'puppeteer*'
        patterns:
          - '*'
      puppeteer:
        patterns:
          - 'puppeteer*'
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
      day: 'sunday'
      time: '04:00'
      timezone: Europe/Berlin
    open-pull-requests-limit: 10
    groups:
      all:
        patterns:
          - '*'

enable-beta-ecosystems: true
security-updates-only: true

Expected Outcome

After this change:

• Dependabot will only create PRs for dependencies with known security vulnerabilities
• No PRs for breaking changes, features, or bug fixes
• Security updates will still be grouped according to the existing configuration (production, dev, puppeteer groups)
• Maximum of 10 open PRs at a time to prevent spam

This pull request was created from Copilot chat.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.