[Gerrrt]

What changed

.github/dependabot.yml only:

• The sensitive entry's Postgres-major ignore now names immich-app/postgres, not ghcr.io/immich-app/postgres.
• open-pull-requests-limit is raised above each entry's image count: observability 5→25 (21 images), soc+scratch 5→20 (13, plus scratch's new Caddy in fix(lab): fence lab Grafana, BloodHound and scratch's UIs to Hicks #1429), lab 5→10 (6), media 5→10 (5), bloodhound 5→10 (4, plus its new Caddy in fix(lab): fence lab Grafana, BloodHound and scratch's UIs to Hicks #1429).
• Both Grafana < 13.2.4 ignores are deleted. Both pins are 13.3.0, and the comment said to drop them at 13.2.4.
• The sensitive entry's comment no longer says the others use 5.

Why

Dependabot names a ghcr.io image without the registry. Its own commits here read Bump immich-app/immich-server, Bump advplyr/audiobookshelf. The prefixed rule matched nothing, so a Postgres major could open, merge and deploy on trinity within the hour.

A limit below the image count drops bumps silently. That's how the Mealie fix for 9 critical CVEs was missed on 2026-11-08. The sensitive entry was fixed then; the other entries weren't.

Closes #1433.

Source: Phase 1 audit, finding #12, plus Pass 1's dead-rule row.

Blast radius

Dependabot's PR volume: more PRs can be open at once on a busy Sunday. Ignore scope: Postgres majors on sensitive are now actually ignored, and Grafana releases below 13.2.4 are offered again, but none is newer than the 13.3.0 pin.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• Name format: git log --all --format=%s shows chore(deps): Bump immich-app/immich-server in /stacks/sensitive (#1321) and Bump advplyr/audiobookshelf in /stacks/media (#1269), so names never carry ghcr.io/.

• Limits: counted image: lines per directory with a script (observability 21, lab 6, sensitive 23, soc+scratch 13, media 5, wiki 3, sensor 3, bloodhound 4, analyst 2). Every entry is now above its count.

• The file parses as YAML. editorconfig-checker: clean.

• make validate: exit 0, 166 PASS, 0 FAIL, 39 SKIP (the same Docker/pipx skips as earlier PRs). Lint's yamllint is among them (no pipx).

• Proven only by the next Sunday run: that Dependabot reads the new limits and name as intended. GitHub validates dependabot.yml on push and reports errors in the repo's Dependabot tab.

• make validate passes (with the skips above)

• Deployed to the lab and confirmed working (N/A; the next Dependabot run)

• Docs updated (N/A: the reasoning is in the file's comments)

---

Generated by Claude Code

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Gerrrt]

Lint and Validate configs failed on f349b9d for a reason unrelated to this PR. Both hit Docker Hub returning 502 Bad Gateway: the koalaman/shellcheck manifest in Lint, and auth.docker.io/token when pulling grafana/alloy for check_mounted_config.py --self-test. This PR changes only .github/dependabot.yml.

There's no fix to port, because the registry was down. I've re-run the failed jobs once.

---

Generated by Claude Code