chore(deps): fix stale Dependabot config + fold in safe dep bumps (go-git, react-router)

.github/dependabot.yml

@@ -1,42 +1,58 @@
 version: 2
 
+# Tracks the post-migration layout: Go server (/server), Go CLI (/cli), the
+# dashboard npm app (/server/dashboard), the server Docker images, and the
+# workflows. The Python backend under legacy/python-api is ARCHIVED
+# (read-only, not built or deployed) so it is intentionally NOT scanned —
+# version bumps there are pure noise. Security updates still run repo-wide
+# regardless of this config.
+
 updates:
-  # Python — pip (api/requirements.txt)
-  - package-ecosystem: "pip"
-    directory: "/api"
+  # Go — server (cix-server)
+  - package-ecosystem: "gomod"
+    directory: "/server"
     schedule:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    groups:
+      go:
+        patterns: ["*"]
     labels:
       - "dependencies"
-      - "python"
+      - "go"
 
-  # Python — uv / pyproject.toml
-  - package-ecosystem: "pip"
-    directory: "/"
+  # Go — CLI (cix)
+  - package-ecosystem: "gomod"
+    directory: "/cli"
     schedule:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    groups:
+      go:
+        patterns: ["*"]
     labels:
       - "dependencies"
-      - "python"
+      - "go"
 
-  # Go — cli/go.mod
-  - package-ecosystem: "gomod"
-    directory: "/cli"
+  # npm — dashboard (server/dashboard)
+  - package-ecosystem: "npm"
+    directory: "/server/dashboard"
     schedule:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    groups:
+      npm:
+        patterns: ["*"]
     labels:
       - "dependencies"
-      - "go"
+      - "javascript"
 
-  # Docker — api/Dockerfile
+  # Docker — server images (server/Dockerfile + server/Dockerfile.cuda)
   - package-ecosystem: "docker"
-    directory: "/api"
+    directory: "/server"
     schedule:
       interval: "weekly"
       day: "monday"

server/go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/andybalholm/brotli v1.2.1
 	github.com/getkin/kin-openapi v0.135.0
 	github.com/go-chi/chi/v5 v5.2.4
-	github.com/go-git/go-git/v5 v5.19.0
+	github.com/go-git/go-git/v5 v5.19.1
 	github.com/google/uuid v1.6.0
 	github.com/oapi-codegen/runtime v1.4.0
 	github.com/philippgille/chromem-go v0.7.0

server/go.sum

@@ -50,8 +50,8 @@ github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmm
 github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.0 h1:+WkVUQZSy/F1Gb13udrMKjIM2PrzsNfDKFSfo5tkMtc=
-github.com/go-git/go-git/v5 v5.19.0/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4=
 github.com/go-openapi/jsonpointer v0.22.4/go.mod h1:elX9+UgznpFhgBuaMQ7iu4lvvX1nvNsesQ3oxmYTw80=
 github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=