From 8b2dbd9d8716dab37325ad41618a32b12053c324 Mon Sep 17 00:00:00 2001
From: Nicky Leach <nicky@paperclip.ing>
Date: Wed, 19 Aug 2026 09:13:27 -0700
Subject: [PATCH] chore(deps): open one dependabot PR per major update (#11709)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Dependabot keeps the project dependencies current.
> - The npm update rule groups all major updates into one pull request.
> - One blocked major update can stop that grouped pull request.
> - This pull request gives each major update its own pull request.
> - The higher limit keeps the initial major updates and normal updates
visible.

## Linked Issues or Issue Description

**What happened?**

Dependabot grouped all npm major updates into one weekly pull request. A
blocked upgrade stopped the grouped pull request and hid other ready
updates.

**Expected behavior**

Dependabot should open one pull request for each npm major update.

**Steps to reproduce**

1. Read the npm entry in `.github/dependabot.yml`.
2. Run the weekly Dependabot update.
3. Inspect the pull requests for major npm updates.

**Paperclip version or commit**

`master` at the base commit for this pull request.

**Deployment mode**

Not applicable. This change affects repository configuration.

**Installation method**

Not applicable. This change affects repository configuration.

**Agent adapter(s) involved**

Not adapter-specific (repository configuration).

**Database mode**

Not database-related.

**Additional context**

The grouped major update included a blocked `js-yaml` upgrade. Separate
pull requests let other major updates proceed independently.

## What Changed

- Remove the `major-updates` group from the npm Dependabot entry.
- Raise the npm `open-pull-requests-limit` from 10 to 20.
- Keep the GitHub Actions Dependabot entry unchanged.

## Verification

- Run `python3 -c "import yaml;
yaml.safe_load(open('.github/dependabot.yml'))"`.
- Confirm the diff changes only `.github/dependabot.yml`.
- Confirm CI passes on this pull request.

## Risks

This change can open more Dependabot pull requests. The limit of 20
bounds the number of open npm update pull requests. No application code
changes.

## Model Used

OpenAI GPT-5. Tool use and code repository inspection assisted this
change.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` /
`Closes: #` / `Refs #` OR (b) described the issue in-PR following the
relevant issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>
---
 .github/dependabot.yml | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 33caa46d21c..3ad56855a24 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,19 +6,14 @@ updates:
       interval: weekly
       day: monday
       time: "06:00"
-    open-pull-requests-limit: 10
+    # Each dependency update gets its own pull request, including major
+    # version bumps. A grouped major PR cannot merge when one member has
+    # a blocked upgrade, so it hides the other ready majors. Separate PRs
+    # let each major land on its own. The limit holds the initial burst
+    # of pending majors plus the regular minor and patch updates.
+    open-pull-requests-limit: 20
     labels:
       - "dependencies"
-    groups:
-      # Bundle all major version bumps into a single weekly PR so they
-      # stay visible without flooding the PR list. Minor/patch updates
-      # still get individual PRs.
-      major-updates:
-        applies-to: version-updates
-        update-types:
-          - "major"
-        patterns:
-          - "*"
 
   - package-ecosystem: github-actions
     directory: "/"