Switch to monthly Dependabot schedule about shields HOT 1 OPEN

Yeah it is a good challenge. We've been doing things this way for so long that I haven't really thought to question it recently. Here's a few thoughts:

• You are right that there are a small number of packages that account for a lot of PRs. As you say, we bump eslint-plugin-jsdoc, @typescript-eslint/parser, @sentry/node, etc every week and don't get much out of it.
• People do really get worked up about simple-icons updates, but I think that is the only package with that property really.
• One useful property of weekly updates is that it requires time "little and often". I can bash though a week's worth of updates in about an hour usually. Finding an hour a week isn't too cumbersome or daunting. Working though a month's worth of updates probably wouldn't be 4x the effort and you don't have to do them all at once, but I feel like it requires finding a larger block of time (albeit less frequently).
• Another good thing about weekly updates is that one week's worth of updates doesn't tend to generate enough PRs at once that rate limits on tokens are a problem. With a month's worth of updates at once, we might start running into builds failing because we've hit rate limits again when we are running a lot of builds on PRs, in the merge queue, and after merge. I fixed a lot of these issues with #8538 and #9072 but there is some limit on how many builds we can run in a one hour window.
• Switching the schedule shouldn't have any impact on security. We can tell dependabot to treat security updates differently from regular package bumps.

All in all, I don't consider things to be unnecessarily cumbersome as they are. At the same time, I'd be willing to try out a less frequent schedule (monthly, or perhaps fortnightly?) and see how it goes.

from shields.