chore: Update dependabot interval #WPB-26814

[alexandreferris]

---

PR Submission Checklist for internal contributors

• The PR Title

  • conforms to the style of semantic commits messages¹ supported in Wire's Github Workflow²
  • contains a reference JIRA issue number like SQPIT-764
  • answers the question: If merged, this PR will: ... ³

• The PR Description

  • is free of optional paragraphs and you have filled the relevant parts to the best of your ability

---

What's new in this PR?

Issues

Dependabot runs weekly, creating unnecessary noise on small updates

Solutions

Update dependabot interval to monthly

[claude]

PR Review: Update Dependabot interval

Thanks for this cleanup! I reviewed the change against the requested criteria. This is a tiny, low-risk configuration change and it looks correct.

Correctness

• The change swaps interval: "weekly" -> interval: "monthly" for both the gradle and github-actions ecosystems. monthly is a valid value for the Dependabot schedule.interval field, and the YAML remains well-formed.
• The intent (reduce weekly noise from small updates) is applied consistently across both ecosystems, which is good — leaving one on weekly would have been an easy oversight to make.

Considerations (non-blocking)

• Security trade-off: monthly also slows delivery of routine dependency bumps. Note that schedule.interval only governs version updates — Dependabot security updates run independently and are still raised promptly, so CVE fixes are not affected by this change. It's worth confirming security updates are enabled at the repo/org level so the monthly cadence doesn't inadvertently delay urgent fixes. See https://docs.github.com/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates
• Optional — batching instead of slowing: If the goal is less PR noise rather than fewer updates, groups: can bundle multiple bumps into a single PR while keeping a more frequent cadence. Just an alternative worth knowing about; monthly is perfectly reasonable.
• Optional — day/time: With monthly you may want to pin schedule.day/schedule.time so the PRs land predictably. Not required.

Performance / Test coverage

• No runtime code is touched, so there are no performance implications and no tests are applicable.

Summary

LGTM — the change is correct and does exactly what the description states. My only real suggestion is to double-check that Dependabot security updates are enabled so the monthly cadence doesn't delay urgent fixes.