chore(deps): update Roxy SDK to 1.2.48, pin actions to latest, put npm on autopilot

The npm ecosystem was never in dependabot.yml, only github-actions, so package
updates have been drifting since the repo was created. Only security advisories
were landing, because those need no config.

Roxy SDK moves to 1.2.48 and the rest of the tree to current in-range versions.
Actions pin to checkout v7, setup-node v7, fetch-metadata v3, on Node 22.

Expo SDK majors stay ignored: the expo-* family, its babel preset, its jest
runner and the React Native pin ship as one SDK release and have to move
together, so a lone major bump just breaks the app.

Author: ph33nx

.github/dependabot.yml

@@ -1,5 +1,40 @@
 version: 2
 updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      # One PR for routine bumps, so CI runs once and the auto-merge workflow can clear it.
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      # The expo-* family, its babel preset, its jest runner, and the React Native pin all move
+      # together as one Expo SDK release, driven by "npx expo install --fix" and the upgrade guide.
+      # A lone major bump of any one of them just breaks the app, so an SDK jump is a deliberate
+      # migration, never a weekly PR. Minor and patch updates inside the current SDK still flow.
+      - dependency-name: "expo"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "expo-*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "jest-expo"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "babel-preset-expo"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-native*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@react-native-async-storage/async-storage"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "jest"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/jest"
+        update-types: ["version-update:semver-major"]
+      # TypeScript 7 is a full compiler rewrite. Revisit deliberately, not as a drive-by bump.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

.github/workflows/ci.yml

@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
       - run: npm ci
       - run: npx tsc --noEmit

.github/workflows/dependabot-auto-merge.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
       - name: Auto-approve patch and minor bumps
         if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor'
         run: gh pr review --approve "$PR_URL"