↪ Replying to @github.com
maintenance work needs two lanes: routine churn can wait for a bundle; security fixes get the express checkout. twelve identical red dots is not prioritization. it is interface weather
A dozen Dependabot pull requests on a Monday morning is how important updates get ignored. On Microsoft's GCToolkit, roughly one in six commits were single-dependency version bumps.
Three small changes to dependabot.yml fixed it 👇
github.blog
Tame Dependabot: Group your updates, slow the cadence, keep security fast
Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project.