build(deps): let Dependabot update bun.lock; bump ng-icons and node types

[jhosepmyr]

Why Dependabot PRs failed

Dependabot used the npm ecosystem, which edits only package.json. CI installs with bun install --frozen-lockfile, which correctly refuses a package.json that no longer matches bun.lock:

error: lockfile had changes, but lockfile is frozen

The frozen install is intentional: CI must build exactly what the lockfile says. The updater, not CI, has to write the lockfile.

What

• .github/dependabot.yml:
  • package-ecosystem: "bun", which updates bun.lock with package.json (supported for bun ≥ 1.1.39; we use 1.3.14).
  • A ng-icons group, so @ng-icons/core and @ng-icons/lucide move together.
  • TypeScript minor and major bumps are ignored, because Angular 22's compiler requires typescript >=6.0 <6.1; TypeScript moves with Angular upgrades.
• The viable pending bumps, applied with the lockfile:
  • @ng-icons/core and @ng-icons/lucide 33.4 → 34.0 (peer @angular/core >=21);
  • @types/node 25 → 26.

Supersedes

• build(deps): bump @types/node from 25.9.5 to 26.1.1 #37 (@types/node), build(deps): bump @ng-icons/core from 33.4.0 to 34.0.0 #38 (@ng-icons/core) and build(deps): bump @ng-icons/lucide from 33.4.0 to 34.0.0 #40 (@ng-icons/lucide): applied here.
• build(deps): bump typescript from 6.0.3 to 7.0.2 #39 (typescript 7): can't land, since Angular 22 rejects TypeScript ≥ 6.1.

Checks

bun install --frozen-lockfile, lint, test:ci (443 passed, exit 0) and build are green locally.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​node@​25.9.4 ⏵ 26.6.4	+1
	@​ng-icons/​lucide@​33.3.0 ⏵ 34.0.0	+1			+3
	@​ng-icons/​core@​33.3.0 ⏵ 34.0.0	+1			+3

View full report