From 71c948fa550fbf18b4dab1ce46f627bbc41e62d0 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Sat, 26 Sep 2026 23:17:00 +0100
Subject: [PATCH] Defer incompatible npm major updates to explicit migrations

Keep ESLint 10 and lucide-solid 1.x out of automatic version updates while their lockfile and icon-import contracts fail. Preserve minor and patch updates and guard the rule in Dependabot policy tests.

Change-source: pulse-maintainer
---
 .github/dependabot.yml                  | 11 +++++++++++
 scripts/tests/test_dependabot_config.py | 22 +++++++++++++++-------
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 524fe6c9d0..4ad2ca6b0d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -119,6 +119,17 @@ updates:
       - dependency-name: "typescript"
         update-types:
           - "version-update:semver-major"
+      # ESLint 10's proposed lockfile drops every js-yaml copy, which breaks the
+      # checked-in dependency-security contract. Migrate the lint stack and
+      # its lockfile together rather than accepting an isolated major bump.
+      - dependency-name: "eslint"
+        update-types:
+          - "version-update:semver-major"
+      # lucide-solid 1.x removes an icon subpath still imported by the app.
+      # Keep majors explicit until the icon imports and frontend proof migrate.
+      - dependency-name: "lucide-solid"
+        update-types:
+          - "version-update:semver-major"
 
   - package-ecosystem: "docker"
     directories:
diff --git a/scripts/tests/test_dependabot_config.py b/scripts/tests/test_dependabot_config.py
index 8aba5d798d..2a07d72344 100644
--- a/scripts/tests/test_dependabot_config.py
+++ b/scripts/tests/test_dependabot_config.py
@@ -150,16 +150,24 @@ class DependabotConfigTest(unittest.TestCase):
         }
         self.assertEqual(
             set(ignored),
-            {"playwright", "playwright-core", "@playwright/test", "typescript"},
+            {
+                "playwright",
+                "playwright-core",
+                "@playwright/test",
+                "typescript",
+                "eslint",
+                "lucide-solid",
+            },
         )
         for browser_runtime in ("playwright", "playwright-core", "@playwright/test"):
             self.assertEqual(ignored[browser_runtime], all_semver)
-        # TypeScript majors must land with the @typescript-eslint peer range
-        # (">=4.8.4 <6.1.0"), so keep them as explicit work.
-        self.assertEqual(
-            ignored["typescript"],
-            {"version-update:semver-major"},
-        )
+        # These majors require an explicit toolchain or icon-import migration.
+        # Minor and patch version updates must remain eligible for Dependabot.
+        for dependency in ("typescript", "eslint", "lucide-solid"):
+            self.assertEqual(
+                ignored[dependency],
+                {"version-update:semver-major"},
+            )
 
     def test_github_actions_updates_preserve_reviewed_action_pins(self) -> None:
         # action_consumer_manifests.json pins each release-consumed action to an