chore(deps): switch Dependabot to security-only (suppress version bumps)

[shivasurya]

Summary

Switches .github/dependabot.yml from "weekly version-bump PRs" to "security-update PRs only." Implemented via open-pull-requests-limit: 0 on every ecosystem block, the GitHub-documented way to keep an ecosystem registered for security updates while suppressing routine version bumps.

Why

Supply-chain attacks via npm / PyPI / Go modules have become routine: chained typosquats, post-install scripts, account takeovers of maintainer accounts. A constant stream of "bump X from 1.2.3 to 1.2.4" PRs produces alert fatigue and tempts a quick rubber-stamp on a malicious release. Reserving Dependabot's noise budget for actual advisories keeps reviewer attention where it matters.

What still works

• Dependabot security updates continue to open PRs when a tracked manifest contains a dependency with a published advisory. Security update PRs are NOT subject to the open-pull-requests-limit knob (per the GitHub docs).
• The seven-manifest allowlist stays. It scopes BOTH version updates AND security updates, so the deliberately vulnerable fixtures under rules/** and sast-engine/test-fixtures/** are still ignored.
• Existing labels and chore(deps) commit prefix carry over to security update PRs. New security label added across all blocks so the PRs that do open are immediately filterable.

Severity filtering (your "high and critical only" ask)

open-pull-requests-limit can't filter by CVE severity. The supported mechanism is auto-triage rules under Settings → Security → Dependabot → Auto-triage rules:

1. Add a rule with severity <= medium, action = "Auto-dismiss alert", reason = tolerable_risk (or inaccurate).
2. Optionally a second rule limiting auto-update PRs to severity >= high.

That dismisses the underlying alerts so they also vanish from the Security tab. The file header documents this.

Follow-up after merge (planned in the next batch)

Close the in-flight dependabot version-bump PRs (#707–#711 and any that landed since this morning). Those were queued before this config took effect; they would otherwise sit open and contradict the new posture.

Test plan

• YAML syntax valid.
• All 8 blocks have open-pull-requests-limit: 0.
• groups block removed where present (no-op with limit 0; removed for clarity).
• Allowlist of seven real manifest locations unchanged.
• After merge: confirm via the Dependabot tab that no new version-update PRs are opened, and that a synthetic security update (e.g., next published CVE on a tracked dep) still produces a PR.

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	1
Rules	205

---

_{Powered by Code Pathfinder}

[code-pathfinder]

Pathfinder Report

✅ No security findings on the changed files. This pull request is clean.

View report on the dashboard

---

Powered by Code Pathfinder.