From dfd3de6e9bee3f9b102c0e1f6c029f43e89f7c1e Mon Sep 17 00:00:00 2001
From: Alex Luckett <alexgluckett@gmail.com>
Date: Thu, 5 Mar 2026 12:10:57 +0000
Subject: [PATCH 1/3] chore: improve dependabot grouping and consistency

---
 .github/dependabot.yml | 60 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 29a36042e..4a14431b2 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,8 +18,13 @@ updates:
           - 'core-js'
           - 'cssnano'
           - 'cssnano-*'
+          - 'i18next'
+          - 'i18next-*'
           - 'postcss'
           - 'postcss-*'
+          - 'react'
+          - 'react-*'
+          - '*-react'
           - 'sass-embedded'
           - 'tsc-alias'
           - 'typescript'
@@ -28,6 +33,8 @@ updates:
 
         # Exclude packages in other groups
         exclude-patterns:
+          - 'eslint-plugin-react'
+          - 'eslint-plugin-react-hooks'
           - 'postcss-scss'
 
       lint:
@@ -52,15 +59,63 @@ updates:
 
       tools:
         patterns:
+          - '@testing-library/*'
+          - 'cheerio'
           - 'concurrently'
           - 'global-jsdom'
           - 'jest'
+          - 'jest-*'
           - 'jsdom'
+          - 'nock'
           - 'tsx'
 
       types:
         patterns:
           - '@types/*'
+          - 'oidc-client-ts'
+
+      forms:
+        patterns:
+          - '@defra/forms-model'
+          - '@defra/forms-engine-plugin'
+
+      aws:
+        patterns:
+          - '@aws-sdk/*'
+          - 'aws-embedded-metrics'
+
+      hapi:
+        patterns:
+          - '@hapi/*'
+          - 'blankie'
+          - 'blipp'
+          - 'hapi-*'
+          - '*-hapi'
+          - 'joi'
+
+      frontend:
+        patterns:
+          - '@dagrejs/dagre'
+          - '@defra/interactive-map'
+          - 'accessible-autocomplete'
+          - 'govuk-frontend'
+          - 'highlight.js'
+          - 'humanize-duration'
+          - 'liquidjs'
+          - 'nunjucks'
+          - 'prismjs'
+          - 'svgo'
+
+      runtime:
+        patterns:
+          - '@defra/hapi-tracing'
+          - 'dotenv'
+          - 'ioredis'
+          - 'js-yaml'
+          - 'marked'
+          - 'minimatch'
+          - 'mongodb'
+          - 'yaml'
 
     # Schedule run every Monday, local time
     schedule:
@@ -78,6 +133,11 @@ updates:
   - package-ecosystem: github-actions
     directory: /
 
+    groups:
+      actions:
+        patterns:
+          - '*'
+
     # Schedule run every Monday, local time
     schedule:
       interval: weekly

From e0c984eacf6b538f1dbd765b06dc49ff2f3cffa3 Mon Sep 17 00:00:00 2001
From: Alex Luckett <alexgluckett@gmail.com>
Date: Thu, 5 Mar 2026 12:23:17 +0000
Subject: [PATCH 2/3] chore: tailor dependabot groups to packages used in this
 repo

---
 .github/dependabot.yml | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4a14431b2..29ff05341 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,23 +18,18 @@ updates:
           - 'core-js'
           - 'cssnano'
           - 'cssnano-*'
-          - 'i18next'
-          - 'i18next-*'
           - 'postcss'
           - 'postcss-*'
           - 'react'
           - 'react-*'
           - '*-react'
           - 'sass-embedded'
-          - 'tsc-alias'
           - 'typescript'
           - 'webpack'
           - 'webpack-*'
 
         # Exclude packages in other groups
         exclude-patterns:
-          - 'eslint-plugin-react'
-          - 'eslint-plugin-react-hooks'
           - 'postcss-scss'
 
       lint:
@@ -60,7 +55,6 @@ updates:
       tools:
         patterns:
           - '@testing-library/*'
-          - 'cheerio'
           - 'concurrently'
           - 'global-jsdom'
           - 'jest'
@@ -72,17 +66,10 @@ updates:
       types:
         patterns:
           - '@types/*'
-          - 'oidc-client-ts'
 
       forms:
         patterns:
           - '@defra/forms-model'
-          - '@defra/forms-engine-plugin'
-
-      aws:
-        patterns:
-          - '@aws-sdk/*'
-          - 'aws-embedded-metrics'
 
       hapi:
         patterns:
@@ -90,12 +77,10 @@ updates:
           - 'blankie'
           - 'blipp'
           - 'hapi-*'
-          - '*-hapi'
           - 'joi'
 
       frontend:
         patterns:
-          - '@dagrejs/dagre'
           - '@defra/interactive-map'
           - 'accessible-autocomplete'
           - 'govuk-frontend'
@@ -103,18 +88,13 @@ updates:
           - 'humanize-duration'
           - 'liquidjs'
           - 'nunjucks'
-          - 'prismjs'
-          - 'svgo'
 
       runtime:
         patterns:
           - '@defra/hapi-tracing'
           - 'dotenv'
           - 'ioredis'
-          - 'js-yaml'
           - 'marked'
-          - 'minimatch'
-          - 'mongodb'
           - 'yaml'
 
     # Schedule run every Monday, local time

From afc63af324cf67da23bed1ef362a59997e7715b4 Mon Sep 17 00:00:00 2001
From: Alex Luckett <alexgluckett@gmail.com>
Date: Thu, 5 Mar 2026 12:36:37 +0000
Subject: [PATCH 3/3] chore: add patch-only catch-all dependabot group

---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 29ff05341..757cf4126 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -97,6 +97,12 @@ updates:
           - 'marked'
           - 'yaml'
 
+      dependencies:
+        patterns:
+          - '*'
+        update-types:
+          - patch
+
     # Schedule run every Monday, local time
     schedule:
       interval: weekly