From 63826a4869b8afc032e2403d41af47b021162275 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Wed, 22 Jul 2026 01:03:22 +0200 Subject: [PATCH] chore(dependabot): stop auto-PRing npm major bumps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Group config already batches minor/patch; majors fall outside the group and each opens its own PR (zod 4, typescript 7, transformers 4, msal-react 5, react-leaflet 5, react 19, @types/node 26, eslint-config-next 16 — all breaking). Ignore version-update:semver-major for both npm ecosystems so majors are reviewed deliberately instead of flooding the PR list. Security updates are exempt from this filter, so vulnerability fixes still flow. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f5510755..8d472a33 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -20,6 +20,11 @@ updates: web: patterns: ['*'] update-types: [minor, patch] + # Major bumps are breaking and reviewed deliberately, not auto-PR'd. + # Security updates ignore this filter, so the Security tab stays clean. + ignore: + - dependency-name: '*' + update-types: ['version-update:semver-major'] - package-ecosystem: npm directory: /src/McpServer/autopilot-monitor-mcp @@ -30,6 +35,11 @@ updates: mcp: patterns: ['*'] update-types: [minor, patch] + # Major bumps are breaking and reviewed deliberately, not auto-PR'd. + # Security updates ignore this filter, so the Security tab stays clean. + ignore: + - dependency-name: '*' + update-types: ['version-update:semver-major'] - package-ecosystem: github-actions directory: /