Daily Dependabot runs with up to 10 concurrent PRs were generating many lockfile/license-touching PRs in parallel, creating persistent merge-conflict churn across open dependency PRs. This change reduces concurrency pressure by batching most updates while preserving isolation for high-churn/high-risk dependencies.

• Main Gradle config (directory: "/")

  • switched to weekly on monday
  • reduced open-pull-requests-limit from 10 to 5
  • kept OpenTelemetry updates isolated in a dedicated opentelemetry group (including semconv patterns)
  • replaced narrow groups with a catch-all all-dependencies group limited to minor/patch updates, so major bumps remain isolated as individual PRs

• Other ecosystems aligned

  • github-actions ("/"): switched to weekly and added catch-all grouping
  • gradle ("/perf-tests"): switched to weekly, reduced PR limit to 5, added catch-all minor/patch grouping
  • gradle ("/etw/etw-testapp"): switched to weekly, reduced PR limit to 5, added catch-all minor/patch grouping

• Preserved as-is

  • all existing ignore rules and comments
  • registries configuration
  • gradle-plugin-portal references on each Gradle update entry

Example of the new grouping pattern (order-sensitive; OpenTelemetry first, catch-all second):

groups:
  opentelemetry:
    patterns:
      - "io.opentelemetry:opentelemetry-bom"
      - "io.opentelemetry.semconv:opentelemetry-semconv"
      # ...
  all-dependencies:
    patterns:
      - "*"
    update-types:
      - "minor"
      - "patch"

This targets the root cause (too many concurrent dependency PRs) rather than conflict-resolution automation. Tradeoff: grouped updates reduce immediate culprit isolation when a batch fails; mitigations are OpenTelemetry isolation and keeping major bumps separate. Configuration is straightforward to tune/revert if batching is too coarse.