Group Dependabot bumps into one PR per ecosystem; apply all pending bumps

.github/dependabot.yml

@@ -0,0 +1,51 @@
+# Dependabot configuration.
+#
+# Every ecosystem/directory below uses a single catch-all group, so Dependabot
+# opens one combined PR per ecosystem+directory instead of one PR per package.
+# The groups apply to both scheduled version updates and security updates.
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/infra"
+    schedule:
+      interval: "weekly"
+    groups:
+      all-pip-dependencies:
+        applies-to: version-updates
+        patterns:
+          - "*"
+      all-pip-security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directories:
+      - "/"
+      - "/static/settings"
+      - "/static/datatable"
+    schedule:
+      interval: "weekly"
+    groups:
+      all-npm-dependencies:
+        applies-to: version-updates
+        patterns:
+          - "*"
+      all-npm-security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      all-github-actions:
+        applies-to: version-updates
+        patterns:
+          - "*"
+      all-github-actions-security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"

infra/requirements-core.txt

@@ -8,7 +8,7 @@ django-registration==5.2.1
 django-social-share==2.3.0
 django-sortedm2m==4.0.0
 django-storages==1.14.6
-Django==4.2.30
+Django==5.2.16
 rcvformats==0.0.46
 selenium==4.31.0  # Stay below 4.32.0 until this is fixed: https://github.com/SeleniumHQ/selenium/issues/15772
 requests==2.33.0