From 1aff3f04bf5dfc9fc35ba0a32de0a7652651fbc4 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 30 May 2026 19:49:32 +0100
Subject: [PATCH] =?UTF-8?q?chore(deps):=20apply=20estate=20dependabot=20po?=
 =?UTF-8?q?licy=20=E2=80=94=20ignore=20semver-major=20(standards#301)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds the canonical ignore block:
  - dependency-name: "*"
    update-types: ["version-update:semver-major"]
to each non-github-actions ecosystem entry (9 entries: 5 cargo + mix + npm + pip + nix).

Estate policy standards#301 (docs/DEPENDABOT-POLICY.adoc) requires this shape after the 2026-05-29 echidna #120-#124 incident where 5 unattended major bumps broke main for ~24h. Major bumps should land via author-supplied PRs paired with call-site updates; minor + patch continue to flow via dependabot.

Supersedes the existing per-library risky bumps:
- #147 reqwest 0.12→0.13
- #145 config 0.14→0.15
- #144 symphonia 0.5→0.6
- #136 rusqlite 0.31→0.40 (will close)
- #135 nix 0.30→0.31
- #146 thiserror 1→2
- #142 colored 2→3
---
 .github/dependabot.yml | 54 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 49156cbf..77c3686c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -21,20 +21,44 @@ updates:
       interval: "daily"
 
   # Rust/Cargo - standalone crates
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "cargo"
     directory: "/czech-file-knife"
     schedule:
       interval: "daily"
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "cargo"
     directory: "/panoptes"
     schedule:
       interval: "daily"
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "cargo"
     directory: "/personal-sysadmin"
     schedule:
       interval: "daily"
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "cargo"
     directory: "/displace"
@@ -42,25 +66,55 @@ updates:
       interval: "daily"
 
   # Elixir/Mix
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "mix"
     directory: "/"
     schedule:
       interval: "daily"
 
   # Node.js/npm
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
 
   # Python/pip
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "daily"
 
   # Nix flakes
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "nix"
     directory: "/"
     schedule:
       interval: "daily"
+    ignore:
+      # Estate policy standards#301 / docs/DEPENDABOT-POLICY.adoc:
+      # ignore semver-major bumps so they land via author-supplied PRs
+      # paired with call-site updates. Minor + patch flow normally.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]