[belaboe]

Problem

Review follow-up for #874 (comment): the header bullet said increase raises the minimum "not only the lockfile", which suggests the previous behaviour was lockfile-only. It wasn't: with auto, Dependabot treats the root package.json as an app and already resolves to increase. The bullet also didn't say that Dependabot never edits peerDependencies.

Issue #, if available: stacked on #874 (base: belaboe/dependabot-versioning-increase).

Changes

• Header bullet rewritten along the reviewer's suggestion: increase does what the ncu job does and pins what auto already resolves to here, and the aws-cdk-lib / constructs peer floors stay manual. The peer wording is narrower than "never edited": dependabot-core doesn't read peerDependencies, but its package_json_updater.rb rewrites a peer range that is identical to the one it bumps (no package has such a pair today).

versioning-strategy: increase itself stays, as the maintainers decided: it matches what ncu -u --target minor did.

Text for #874's description

Proposed additions to #874's description (this PR doesn't edit it):

• Changesets: ci(release): write the changeset for Dependabot bumps at release time #977 writes the changeset for Dependabot bumps at release time, so the Require changeset check doesn't block Dependabot PRs once the pending changesets on main are used up.
• Peer floors (aws-cdk-lib ^2.257.0, constructs): Dependabot doesn't read peerDependencies (it only rewrites a peer range identical to the one it bumps, none today), so these floors stay manual while the devDependency copies keep rising. Owner: (to be named by maintainers).
• increase vs increase-if-necessary: keep increase (no change from ncu).

Series

Merge order: #873, #874 (this), #935, #875, #977, then #876. #935's header bullet was moved in its review-fix PR, so it no longer conflicts with this one.

Review-fix PRs for the series: #991 (for #873), #992 (#874), #993 (#935), #994 (#875), #995 (#876). Changesets: #977. Migration issue: #984.

Validation

• .github/dependabot.yml validates against the SchemaStore dependabot-2.0 JSON schema; only a comment changes.
• git merge-tree against main: clean.
• Config only, no changeset.

Checklist

• PR description included
• Tests are changed or added (comment only)
• Relevant documentation is changed or added (header comment in dependabot.yml)

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 93c5cac

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR