chore(deps): ignore Django major updates in the python group

[vpetersson]

Keeps Django major version bumps out of the grouped Python Dependabot PR. A Django major is a deliberate migration, not something that should ride in on a routine grouped bump alongside patch-level tooling updates.

Minor and patch updates still flow through, so the 5.2.x line keeps getting security and bug fixes.

Scope

The rule is an exact, case-insensitive name match on Django — not a django* wildcard, which would have swept up five unrelated packages. Verified by simulating dependabot-core's own wildcard_match? logic (it lowercases both sides, so Django and django both match):

Candidate	Ignored
django / Django	yes
django-stubs	no
django-stubs-ext	no
django-dbbackup	no
djangorestframework	no
djangorestframework-stubs	no

ignore sits at the ecosystem level rather than inside groups: — there is no per-group ignore. A group's exclude-patterns would only split Django into its own PR, not suppress the major.

Why this is worth having

Django 6.0.7 is out while the repo pins 5.2.14. I confirmed 6.0.7 resolves cleanly against every current pin (uv lock --dry-run with the pin swapped: Resolved 125 packages, django v5.2.14 -> v6.0.7), and nothing in the tree caps Django below 6 — djangorestframework needs >=4.2, drf-spectacular needs >=2.2. So nothing would stop Dependabot proposing the major on a future run.

Worth noting for context: the first grouped Python run (#3205) did not include Django, so this is a forward-looking guard rather than a fix for something already broken.

Validation

Nothing in CI validates this file — actionlint only covers .github/workflows/, so a malformed config fails silently rather than turning a check red. Verified manually:

• Validates against the official schemastore dependabot-2.0 schema.
• update-types: ["version-update:semver-major"] matches the documented enum.
• Ignore matching simulated against dependabot-core's wildcard_match? (table above).

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Adjusts Dependabot configuration to keep Django major upgrades out of the routine grouped Python dependency update flow, so deliberate framework migrations don’t get bundled with normal tooling bumps while still allowing minor/patch updates for ongoing fixes.

Changes:

• Adds a Dependabot ignore rule for Django limited to version-update:semver-major within the uv ecosystem updates.
• Documents the intent and matching behavior directly in .github/dependabot.yml.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.