From 8ae97c7ff895b1d05fd3608936b7cb0d5ed797e1 Mon Sep 17 00:00:00 2001
From: Tanisha Aberdeen <32620895+aliasunder@users.noreply.github.com>
Date: Sat, 11 Jul 2026 17:05:53 -0400
Subject: [PATCH] =?UTF-8?q?chore:=20expand=20dependabot=20config=20?=
 =?UTF-8?q?=E2=80=94=20npm,=20github-actions,=20docker=20major=20ignore?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds npm (grouped by prod/dev, TS major ignored) and github-actions
ecosystems. Blocks Node major bumps in the Docker ecosystem to match
the engines >=24 <25 pin.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HBJw5bhDigxu8HM2sPPZVf
---
 .github/dependabot.yml | 32 +++++++++++++++++++++++++++++---
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 31b4687..ca80be5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,9 +1,35 @@
-# Keeps the digest-pinned base image in the Dockerfile current — pinning
-# closes the mutable-tag supply-chain hole; Dependabot restores the patch
-# stream the pin would otherwise lose.
 version: 2
 updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      production:
+        dependency-type: production
+      development:
+        dependency-type: development
+    ignore:
+      # typescript-eslint's peer range caps TypeScript — a TS major in
+      # the dev group breaks npm ci with ERESOLVE. TS majors are a
+      # deliberate decision gated on typescript-eslint support.
+      - dependency-name: typescript
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+
+  # Keeps the digest-pinned FROM lines in the Dockerfile current when
+  # upstream node:24-slim rebuilds (e.g. Debian security releases).
   - package-ecosystem: docker
     directory: /
     schedule:
       interval: weekly
+    ignore:
+      # A base-image major is a Node.js major — the action pins
+      # engines >=24 <25 (.nvmrc, package.json). Node version
+      # upgrades are deliberate, not dependency churn.
+      - dependency-name: node
+        update-types: ["version-update:semver-major"]