Defer incompatible npm major updates to explicit migrations

Keep ESLint 10 and lucide-solid 1.x out of automatic version updates while their lockfile and icon-import contracts fail. Preserve minor and patch updates and guard the rule in Dependabot policy tests.

Change-source: pulse-maintainer

.github/dependabot.yml

@@ -119,6 +119,17 @@ updates:
       - dependency-name: "typescript"
         update-types:
           - "version-update:semver-major"
+      # ESLint 10's proposed lockfile drops every js-yaml copy, which breaks the
+      # checked-in dependency-security contract. Migrate the lint stack and
+      # its lockfile together rather than accepting an isolated major bump.
+      - dependency-name: "eslint"
+        update-types:
+          - "version-update:semver-major"
+      # lucide-solid 1.x removes an icon subpath still imported by the app.
+      # Keep majors explicit until the icon imports and frontend proof migrate.
+      - dependency-name: "lucide-solid"
+        update-types:
+          - "version-update:semver-major"
 
   - package-ecosystem: "docker"
     directories:

scripts/tests/test_dependabot_config.py

@@ -150,16 +150,24 @@ class DependabotConfigTest(unittest.TestCase):
         }
         self.assertEqual(
             set(ignored),
-            {"playwright", "playwright-core", "@playwright/test", "typescript"},
+            {
+                "playwright",
+                "playwright-core",
+                "@playwright/test",
+                "typescript",
+                "eslint",
+                "lucide-solid",
+            },
         )
         for browser_runtime in ("playwright", "playwright-core", "@playwright/test"):
             self.assertEqual(ignored[browser_runtime], all_semver)
-        # TypeScript majors must land with the @typescript-eslint peer range
-        # (">=4.8.4 <6.1.0"), so keep them as explicit work.
-        self.assertEqual(
-            ignored["typescript"],
-            {"version-update:semver-major"},
-        )
+        # These majors require an explicit toolchain or icon-import migration.
+        # Minor and patch version updates must remain eligible for Dependabot.
+        for dependency in ("typescript", "eslint", "lucide-solid"):
+            self.assertEqual(
+                ignored[dependency],
+                {"version-update:semver-major"},
+            )
 
     def test_github_actions_updates_preserve_reviewed_action_pins(self) -> None:
         # action_consumer_manifests.json pins each release-consumed action to an