ci(deps): stop dependabot proposing majors it cannot resolve

Three of the nine open dependency PRs failed for reasons in my own config
rather than anything wrong with the dependency:

- The dev-tooling group bundled majors, producing a PR that raised
  typescript 5 -> 7 while leaving typescript-eslint at 8, which does not
  support it. npm could not resolve it, so the PR was red by construction.
  The group is now minor and patch only.
- @eslint/js 10 requires eslint 10, so proposing it on its own can never
  install. Majors of eslint, @eslint/js and typescript are now ignored:
  they are migrations, and TypeScript 7 is a different compiler.
- The PR title check required a lower-case subject, which failed
  'ci(deps): Bump gitleaks-action from 2 to 3'. Dependabot capitalises some
  titles and not others, so the rule rejected dependency PRs for a reason
  no human chose. Only a trailing full stop is rejected now.

Majors of commander and diff join ws and chokidar in the ignore list. All
four reach a user's machine and can change behaviour against a live
instance, so they should be a deliberate decision rather than a routine PR.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking

.github/dependabot.yml

@@ -16,6 +16,12 @@ updates:
       # and a bump is never interesting on its own.
       dev-tooling:
         dependency-type: development
+        # Minor and patch only. Grouped majors produced an internally inconsistent
+        # PR — typescript 5 -> 7 alongside typescript-eslint 8, which does not
+        # support it — that could never install, let alone pass.
+        update-types:
+          - minor
+          - patch
         patterns:
           - '@typescript-eslint/*'
           - 'typescript-eslint'
@@ -24,12 +30,25 @@ updates:
           - 'typescript'
           - '@types/*'
     ignore:
-      # Majors reach a user's machine and can change runtime behaviour against a
-      # live instance; review those deliberately rather than as a routine PR.
+      # Every runtime dependency: a major reaches a user's machine and can change
+      # behaviour against a live instance, so it deserves a deliberate look rather
+      # than a routine PR that sits there red.
       - dependency-name: 'ws'
         update-types: ['version-update:semver-major']
       - dependency-name: 'chokidar'
         update-types: ['version-update:semver-major']
+      - dependency-name: 'commander'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'diff'
+        update-types: ['version-update:semver-major']
+      # Toolchain majors are migrations, not bumps. TypeScript 7 in particular is a
+      # different compiler; typescript-eslint has to support it first.
+      - dependency-name: 'typescript'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'eslint'
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@eslint/js'
+        update-types: ['version-update:semver-major']
 
   - package-ecosystem: github-actions
     directory: /

.github/workflows/pr-title.yml

@@ -42,8 +42,11 @@ jobs:
             deps
             docs
           requireScope: false
-          # Subject should read like a sentence fragment, lower-case, no full stop.
-          subjectPattern: ^(?![A-Z])(?!.*\.$).+$
+          # Only the trailing full stop is rejected. A lower-case rule was tried and
+          # removed: Dependabot capitalises some of its titles ("Bump x from 1 to 2")
+          # and not others, so it failed dependency PRs for a reason unrelated to
+          # anything a human chose.
+          subjectPattern: ^(?!.*\.$).+$
           subjectPatternError: |
-            The subject "{subject}" is invalid: start lower-case and omit the trailing
-            full stop, e.g. "feat(logs): stream the server log".
+            The subject "{subject}" must not end with a full stop, e.g.
+            "feat(logs): stream the server log".