From 64a8ab6944b23141183e7b7b3a4a6ccad5a8f5ad Mon Sep 17 00:00:00 2001
From: SnapOtter <snapotter.hq@gmail.com>
Date: Fri, 1 May 2026 14:16:32 +0800
Subject: [PATCH] chore: ignore major version bumps in dependabot for pip and
 docker

Dependabot was creating orphaned branches for risky major bumps
(Node 22->25, CUDA 12->13, Pillow 11->12, onnxruntime 1.20->1.25)
without opening PRs. These require manual evaluation, not auto-update.
Aligns pip and docker config with the npm ecosystem which already
ignores major bumps.
---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4bc49a0d..7e30e214 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -30,6 +30,9 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   # Docker base images
   - package-ecosystem: "docker"
@@ -38,6 +41,9 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 3
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   # GitHub Actions
   - package-ecosystem: "github-actions"