tone down dependabot

Author: lherman-cs

.github/dependabot.yml

@@ -1,23 +1,42 @@
 version: 2
 updates:
   # Maintain dependencies for Cargo
-  - package-ecosystem: cargo
+  - package-ecosystem: "cargo"
     directory: "/"
     schedule:
-      interval: daily
-    open-pull-requests-limit: 10
+      # Only check for updates once a month.
+      interval: "monthly"
+    # Don't allow more than 2 open pull requests for version updates.
+    # Security updates are not affected by this limit.
+    open-pull-requests-limit: 2
+    # Group all Cargo version updates into a single pull request.
+    # This means you'll get one PR for all cargo deps, not one for each.
+    groups:
+      cargo-dependencies:
+        patterns:
+          - "*"
 
   # Maintain dependencies for NPM
-  - package-ecosystem: npm
+  - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: daily
-    open-pull-requests-limit: 10
+      # Only check for updates once a month.
+      interval: "monthly"
+    open-pull-requests-limit: 2
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
 
   # Maintain dependencies for GitHub Actions
-  - package-ecosystem: github-actions
+  - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: daily
-    open-pull-requests-limit: 10
-
+      # Only check for updates once a month.
+      interval: "monthly"
+    open-pull-requests-limit: 2
+    # Group all GitHub Actions updates into a single pull request.
+    groups:
+      github-actions:
+        patterns:
+          - "*"