dependabot-limit-zero-blocks-bumps-not-security

Setting open-pull-requests-limit: 0 on all dependabot ecosystems stops weekly version-bump PRs entirely while GitHub’s separate security advisory mechanism continues to surface CVE-driven patches. This is the correct production posture for locked L2 stacks: security coverage without weekly major-version churn.

Related

• pydantic-prod-safety-validator-rejects-dev-defaults-at-boot
• env-var-naming-drift-causes-silent-prod-boot-with-dev-defaul
• alembic-ini-db-url-triggers-secret-scanner-on-commit
• pydantic-model-validator-prod-safety-gate-pattern
• pydantic-model-validator-prod-safety-gate
• dependabot-first-cycle-floods-repo-with-prs