[wyre-agent-fleet]

What

Excludes msw, vitest, and @vitest/* from the auto-merged dev-dependencies Dependabot
group's major bumps. Minor/patch bumps of these packages are unaffected -- they stay
grouped and auto-merged exactly as before, via a second, narrower group.

Why

A grouped Dependabot PR that bundles a msw major bump (2.x -> 3.x) together with a vitest
major bump (4.x -> 5.x) can produce an internally-inconsistent lockfile: npm ci fails with
EUSAGE because the nested msw@2.x subtree that @vitest/mocker's peer dependency still
needs is missing. Dependabot's own version-resolution step doesn't catch this at PR-creation
time, and a casual local npm ci can falsely look clean -- a newer local npm version silently
auto-heals the same gap, so the bug only reproduces reliably against CI's exact npm version in
a clean container.

Confirmed independently across 8 repos during the 2026-10-08 fleet burn-down (rootly-mcp#65,
node-syncro#72, node-it-glue#83, node-threatlocker#34, node-domotz#51, ironscales-mcp#57,
node-halopsa#86, node-datto-saas-protection#57) -- same root cause every time, not an edge case.

Fix

Majors for msw/vitest/@vitest/* now fall through ungrouped into individual PRs, held for
human review -- the same treatment production-dependency majors already get. This stops the
auto-merge-on-green janitor from landing an unverified, potentially-broken lockfile. Minor/patch
updates to these packages remain grouped and auto-merged, so routine PR volume is unaffected.

Config-only change, fleet-wide rollout across the 30 *-mcp/node-* repos confirmed to carry
both msw and vitest as direct devDependencies with this dependabot.yml template. No
application code touched.

Ref: task_1791494841949 (murph)

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Chores
  • Updated how development package updates are grouped: minor and patch updates for selected testing and request-mocking packages are grouped together, while major updates are listed separately. Other development package updates remain grouped across version types. No user-facing functionality changed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3e0837f0-d50d-41c9-aa14-9be59c4bbb64

📥 Commits

Reviewing files that changed from the base of the PR and between d0d36e2 and 06b6bf1.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

📝 Walkthrough

Walkthrough

The Dependabot configuration separates msw, vitest, and @vitest/* from other development dependencies. Their minor and patch updates are grouped separately, while their major updates remain outside both groups.

Changes

Development dependency update groups

Layer / File(s)	Summary
Configure development dependency groups .github/dependabot.yml	The general development dependency group excludes msw, vitest, and @vitest/*. A separate group includes minor and patch updates for those packages.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: asachs01

Merge Risk: ⚪ Minimal · up to 06b6b

Selected major updates will remain individual PRs for review. Minor and patch updates are assigned to their own group; whether the external auto-merge service recognizes that group could not be confirmed, and no concrete merge-blocking issue is established.

Architecture Summary

Architecture risk: 🔵 Low · up to 06b6b

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/dependabot.yml: The dev-dependencies group now excludes msw, vitest, and @vitest/*; previously, all development dependencies, including these packages, were grouped for major, minor, and patch updates.
• observed — Modified behavior in .github/dependabot.yml: A new development-dependency group groups minor and patch updates for msw, vitest, and @vitest/*; their major updates are not included in this group.

Pre-merge checks · 5 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Changelog Entry		The PR changes .github/dependabot.yml: it excludes msw, vitest, and @vitest/* from grouped major updates and adds a minor/patch group. This is a configuration change and addresses broken group…	Add a changelog entry beneath ## [Unreleased] in the Fixed section for the Dependabot grouping change that prevents incompatible msw/vitest major updates from being auto-merged.

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the Dependabot configuration change and the main affected packages. It accurately states that major updates are ungrouped.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Changelog Entry

Explanation

The PR changes .github/dependabot.yml: it excludes msw, vitest, and @vitest/* from grouped major updates and adds a minor/patch group. This is a configuration change and addresses broken grouped lockfiles. The PR does not modify CHANGELOG.md, and the existing ## [Unreleased] section has no entry for this change.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 This PR is included in version 1.0.6 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀