Watch: Dependabot group-by:dependency-name not collapsing cross-directory PRs (upstream dependabot-core#14286)

[scottschreckengaust]

Summary

Track the upstream Dependabot regression that prevents group-by: dependency-name from collapsing version-update PRs across directories, so we can drop our interim throttles once it's fixed.

Background

PR #4267 added group-by: dependency-name to the uv, npm, and docker groups in .github/dependabot.yml to collapse a single dependency's bump across all package directories into one PR (instead of one PR per directory). The config is valid and correct per GitHub's docs, but it is not working — Dependabot still opens one PR per directory.

Evidence (all opened well after #4267 merged 2026-07-16):

• gitpython 3.1.54 → chore(deps): update uv: bump gitpython from 3.1.45 to 3.1.54 in /src/ccapi-mcp-server #4357, chore(deps): update uv: bump gitpython from 3.1.44 to 3.1.54 in /samples/mcp-integration-with-nova-canvas #4358, chore(deps): update uv: bump gitpython from 3.1.44 to 3.1.54 in /samples/mcp-integration-with-kb #4359 (three PRs; chore(deps): update uv: bump gitpython from 3.1.44 to 3.1.54 in /samples/mcp-integration-with-nova-canvas #4358/chore(deps): update uv: bump gitpython from 3.1.44 to 3.1.54 in /samples/mcp-integration-with-kb #4359 are byte-identical 3.1.44 → 3.1.54 bumps that a working group-by would have merged into one)
• setuptools 80.10.2 → 83.0.0 → chore(deps): update uv: bump setuptools from 80.10.2 to 83.0.0 in /src/timestream-for-influxdb-mcp-server #4303, chore(deps): update uv: bump setuptools from 80.10.2 to 83.0.0 in /src/ecs-mcp-server #4305, chore(deps): update uv: bump setuptools from 80.10.2 to 83.0.0 in /src/dynamodb-mcp-server #4306, chore(deps): update uv: bump setuptools from 80.10.2 to 83.0.0 in /src/aws-healthomics-mcp-server #4309, chore(deps): update uv: bump setuptools from 80.10.2 to 83.0.0 in /src/aws-api-mcp-server #4310 (five PRs)
• pillow 12.1.1 → 12.3.0 → chore(deps): update uv: bump pillow from 12.1.1 to 12.3.0 in /src/document-loader-mcp-server #4292, chore(deps): update uv: bump pillow from 12.1.1 to 12.3.0 in /src/aws-healthomics-mcp-server #4293, chore(deps): update uv: bump pillow from 12.1.1 to 12.3.0 in /samples/mcp-integration-with-nova-canvas #4294, chore(deps): update uv: bump pillow from 12.1.1 to 12.3.0 in /samples/mcp-integration-with-kb #4295 (four PRs, identical from→to versions)

The tell is the PR title: ours read bump <dep> ... in /<dir> — Dependabot's individual/ungrouped format. A working group-by yields bump the <group>/<dep> group across N directories (which we do see for ecosystems that don't use group-by, e.g. #4339 "the pip group across 2 directories", #4327 "the github-actions-version-updates group").

Root cause (upstream, not our config)

• group-by: dependency-name is a valid schema key and went default-on when its feature flag was removed in refactor: Remove group_by_dependency_name feature flag dependabot/dependabot-core#14292 (merged 2026-02-27).
• Open upstream bug group-by: individual PRs are now created for each dependency within a group, not for the whole group dependabot/dependabot-core#14286 — "group-by: individual PRs are now created for each dependency within a group, not for the whole group" — reproduces our exact symptom. Notably it repros with explicitly enumerated directories, not just a **/* glob, so rewriting our directories: ["**/*"] to an explicit list is not guaranteed to fix it.

Interim mitigation (this repo)

Since the feature we rely on is broken upstream, PR #4371 adds throttles that don't depend on it, to the uv/npm/docker (and github-actions) entries:

• open-pull-requests-limit: 10 — caps the open queue (default is only 5; a large release like the earlier mcp bump produced ~57 PRs — see chore(deps): update uv: bump mcp to 1.29.0 across all packages (consolidates 57 Dependabot PRs) #4258)
• cooldown: { default-days: 7 } — lets churny releases settle before a PR is raised

We are intentionally not lengthening schedule.interval (kept weekly), and not bulk-closing the current backlog (manageable, handled manually).

What "done" looks like

• group-by: individual PRs are now created for each dependency within a group, not for the whole group dependabot/dependabot-core#14286 is fixed and released
• Confirm a real multi-directory bump collapses into a single PR (title = bump the <group>/<dep> group across N directories)
• Revisit / relax the interim open-pull-requests-limit and cooldown throttles added in PR chore(deps): throttle Dependabot PR volume while cross-directory grouping is broken (upstream #14286) #4371 if desired

References

• Attempted fix: chore(deps): group Dependabot updates across directories to stop the per-directory PR explosion #4267
• Consolidation of a specific bump: chore(deps): update uv: bump mcp to 1.29.0 across all packages (consolidates 57 Dependabot PRs) #4258
• Upstream tracking: group-by: individual PRs are now created for each dependency within a group, not for the whole group dependabot/dependabot-core#14286 (bug), refactor: Remove group_by_dependency_name feature flag dependabot/dependabot-core#14292 (flag removal), Group updates by dependency name across multiple directories in a monorepo dependabot/dependabot-core#13284 / #14046 / #14008 (feature work)