fix(deps): restrict the auto-merged groups to minor and patch

[guarzo]

Fixes a hazard I introduced in #24/#30. Worth merging before any of the open Dependabot PRs are rebased.

What changed and why

linting, testing and types had no update-types restriction, so majors grouped into them — and those are exactly the three groups dependabot-auto-merge.yml auto-merges. The first Dependabot run demonstrated it rather than hypothetically:

#32 linting group:  eslint ^9.39.5 -> ^10.8.0,  @eslint/js ^9 -> ^10
#33 testing group:  vitest ^3.0.0  -> ^4.1.10

Both are green on all three required checks.

My original justification was that these groups "break loudly and immediately in CI." That reasoning does not survive contact with a major. eslint 10 passing npm run lint says nothing about whether its rule semantics moved under the config deliberately tuned in the lint/format stage; vitest 4 passing says nothing about whether test semantics survived. A major that passes CI is the worst case for auto-merge, because there is no signal at all.

All three groups now carry update-types: [minor, patch]. Majors match the patterns but not the update-types, so they fall through every group and arrive as individual PRs.

That fall-through is not an assumption — this run confirmed it. #34 (pg-boss 10 -> 12), #35 (zod 3 -> 4) and #36 (typescript 5.9 -> 7.0) all match minor-and-patch's * pattern, fail its update-types, and arrived as individual PRs.

react and drizzle deliberately keep majors: they must move as a unit, and neither is on the auto-merge list, so a human merges them either way.

The comment in dependabot-auto-merge.yml explaining the group list is updated too — it still claimed CI-fails-loudly as the safety argument, which is now the update-types restriction instead, with a note to check update-types before adding any group to that list.

What CI cannot check

Parsed the config and printed the effective restrictions:

react            update-types=ANY (majors included)
drizzle          update-types=ANY (majors included)
linting          update-types=['minor', 'patch']
testing          update-types=['minor', 'patch']
types            update-types=['minor', 'patch']
minor-and-patch  update-types=['minor', 'patch']

actionlint clean on the workflow. npm run format:check -> All matched files use Prettier code style!.

Dependabot's own behaviour cannot be exercised until it next runs. GitHub validates dependabot.yml on push — check the Insights > Dependency graph > Dependabot tab after merge for a config error.

Deploy notes

None.

Flags

• The seven open Dependabot PRs (chore(deps): bump the actions group across 1 directory with 4 updates #31–chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 #36) never ran the auto-merge workflow: their branches were cut from main before ci: auto-merge Dependabot PRs for bounded-risk groups #30 merged, so the file is not in their merge refs. That accident is the only reason the eslint and vitest majors did not auto-merge. After this lands, @dependabot recreate on the survivors will re-split them correctly.
• chore(deps-dev): bump the linting group with 3 updates #32 and chore(deps-dev): bump vitest from 3.2.7 to 4.1.10 in the testing group #33 should be reviewed by hand regardless of what this config does to future PRs — they already exist in their grouped form.
• Separately: ci: auto-merge Dependabot PRs for bounded-risk groups #30 was blocked from auto-merging by a CodeRabbit CHANGES_REQUESTED review that its rate limit prevented it from ever revisiting. A pull_request ruleset rule blocks on that even with required_approving_review_count: 0. Dependabot PRs are not exposed to it — CodeRabbit reports "Review skipped: bot user not eligible for review" — but any human PR can be wedged the same way.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 16 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 131a740d-8711-4c35-bc67-a0e3dc42ef4b

📥 Commits

Reviewing files that changed from the base of the PR and between 110525d and 319ccdf.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/dependabot-auto-merge.yml

---

_{Comment @coderabbitai help to get the list of available commands.}