build(deps): let Dependabot update bun.lock; bump ng-icons and node types

.github/dependabot.yml

@@ -1,13 +1,14 @@
 # Dependabot opens its PRs from branches named:
 #   dependabot/<ecosystem>/<target-branch>/<group-or-dependency>
-# e.g. dependabot/npm_and_yarn/develop/minor-and-patch
+# e.g. dependabot/bun/develop/minor-and-patch
 #      dependabot/github-actions/develop/actions
 # (the <target-branch> segment appears because we set target-branch: develop.)
 
 version: 2
 updates:
-  # npm / bun dependencies
-  - package-ecosystem: "npm"
+  # Bun dependencies. The "bun" ecosystem updates bun.lock together with package.json; the
+  # "npm" one only touched package.json, so CI's `bun install --frozen-lockfile` refused its PRs.
+  - package-ecosystem: "bun"
     directory: "/"
     schedule:
       interval: "weekly"
@@ -17,6 +18,10 @@ updates:
       - "dependencies"
     commit-message:
       prefix: "build(deps)"
+    ignore:
+      # The Angular toolchain pins TypeScript (Angular 22: >=6.0 <6.1); it moves with Angular.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
     groups:
       angular:
         patterns:
@@ -26,6 +31,9 @@ updates:
       spartan:
         patterns:
           - "@spartan-ng/*"
+      ng-icons:
+        patterns:
+          - "@ng-icons/*"
       minor-and-patch:
         update-types:
           - "minor"

CHANGELOG.md

@@ -11,6 +11,16 @@ follows [Semantic Versioning](https://semver.org/).
 
 _Feature module implementation (iam, billing, workspace, discovery) in progress._
 
+### Fixed (Dependabot PRs failed on the lockfile — `bugfix/dependabot-bun-lockfile`)
+
+- **Dependabot now uses the `bun` ecosystem.** It updates `bun.lock` together with `package.json`. With
+  `npm` it touched only `package.json`, so CI's `bun install --frozen-lockfile` refused every PR.
+- **`@ng-icons/*` are grouped** so `core` and `lucide` move together.
+- **TypeScript minor and major bumps are ignored.** Angular 22 requires `>=6.0 <6.1`, so TypeScript
+  moves with Angular.
+- **Bumps applied here with the lockfile:** `@ng-icons/core` and `@ng-icons/lucide` 33 → 34, and
+  `@types/node` 25 → 26. These supersede Dependabot #37, #38 and #40.
+
 ### Added (US28 — Demo project — `feature/workspace-demo-project`)
 
 - **Every new organization starts with a demo project** with sample data, "Demo · Restaurante La

package.json

@@ -36,8 +36,8 @@
     "@angular/router": "^22.0.0",
     "@jsverse/transloco": "^8.4.0",
     "@jsverse/transloco-locale": "^8.4.0",
-    "@ng-icons/core": "^33.3.0",
-    "@ng-icons/lucide": "^33.3.0",
+    "@ng-icons/core": "^34.0.0",
+    "@ng-icons/lucide": "^34.0.0",
     "@spartan-ng/brain": "^0.0.1-alpha.713",
     "@stomp/rx-stomp": "^2.4.0",
     "rxjs": "~7.8.0",
@@ -55,7 +55,7 @@
     "@playwright/test": "1.61.1",
     "@spartan-ng/cli": "^1.0.4",
     "@tailwindcss/postcss": "^4.1.12",
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.1.1",
     "@vitest/browser-playwright": "^4.1.8",
     "angular-eslint": "22.0.0",
     "eslint": "^10.3.0",