[sabind]

Why

Dependabot's first run after #40 opened separate pull requests for vitest (#43) and @vitest/coverage-v8 (#44). Each failed npm ci, because @vitest/coverage-v8 5.0.5 needs exactly vitest 5.0.5. It also opened #42, which bumped @types/node from 20 to 26. Node 26 types would let code use APIs that Node 22, the oldest supported version, lacks, and the type check wouldn't catch it.

What

Dependabot now updates vitest and every @vitest/* package together in one pull request, majors included, and no longer proposes major updates to @types/node.

Changes

• .github/dependabot.yml:
  • Adds a vitest group matching vitest and @vitest/*, placed before the minor-and-patch group so it takes those packages first.
  • Adds an ignore rule for @types/node version-update:semver-major.
  • Each has a one-line comment giving the reason.

Testing

• The file parses as YAML. The npm ecosystem's groups read vitest, then npm-minor-and-patch, followed by the @types/node ignore rule.
• Dependabot itself runs only on GitHub. After merge, it should close Bump vitest from 4.1.12 to 5.0.5 #43 and Bump @vitest/coverage-v8 from 4.1.12 to 5.0.5 #44 and open one combined vitest update.

Risk and rollout

None. This changes only which update pull requests Dependabot opens.

Notes for reviewers

• @types/node stays at ^20.14.15, below the oldest supported Node, 22. Moving it to ^22 is a separate change.
• The combined vitest 5 update may need changes to vitest.config.ts if vitest 5 changed its coverage options. Its CI will show that.

🤖 Generated with Claude Code