From f8156893fba56ec2ca23cf43ee0a5b3cd8820453 Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <xianpeng.shen@gmail.com>
Date: Sun, 25 Oct 2026 17:04:26 +0200
Subject: [PATCH] chore(deps): keep Dependabot to security updates only

Set open-pull-requests-limit: 0 on every ecosystem to turn off version
updates. Security updates are unaffected.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/dependabot.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2390d8c..c9120b8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    # Security-only maintenance: 0 disables version updates; security updates still open PRs.
+    open-pull-requests-limit: 0
     groups:
       github-actions:
         patterns: