[belaboe]

Problem

Review follow-ups for #935:

• "Majors arrive as their own PRs" holds only on runs where the dev-dependencies group has no open PR. While it has one, Dependabot marks the group's dependencies as handled and opens no PR for their majors (Dependencies matched by group patterns are marked as "handled" regardless of update-types, suppressing major version PRs dependabot/dependabot-core#14202; the fix in Raise individual pull requests for group members that update-types rejects dependabot/dependabot-core#16113 is behind an experiment flag).
• The vite / Svelte majors peer-depend on each other and on TypeScript 6 (@sveltejs/kit@3 needs vite ^8, typescript ^6 and @sveltejs/vite-plugin-svelte ^7; @sveltejs/adapter-node@6 needs kit 3), so a single major PR can't resolve.
• The header bullet conflicted textually with chore(repo): raise package.json minimums in npm Dependabot updates #874's.

Issue #, if available: stacked on #935 (base: ci/dependabot-dev-group-minor-patch). Migration tracked in #984.

Changes

• Header bullet uses the reviewer's wording: majors are raised as their own PRs only on runs where the group has no open PR, and plain npm outdated (root and workspaces) before each release catches the rest.
• Root npm entry ignores semver-major updates of vite, @vitejs/* and @sveltejs/*, with a one-line reason, like the existing typescript / @types/node ones. The migration (Vite 8, SvelteKit 3, TypeScript 6, and the MPL-2.0 lightningcss question for scaffolded apps) is tracked in Migrate test apps and templates to Vite 8, SvelteKit 3 and TypeScript 6 #984. This also cuts the burst of individual major PRs the review expected (about 15, sharing the limit of 10 with ungrouped production PRs); who triages the remaining ones is still for the maintainers to name.
• The bullet moved below the typescript / @types/node bullet, so it no longer touches the lines chore(repo): raise package.json minimums in npm Dependabot updates #874 adds. With the series merged in order, both bullets are kept.

Series

Merge order: #873, #874, #935 (this), #875, #977, then #876. #977 writes the changeset for Dependabot bumps at release time.

Review-fix PRs for the series: #991 (for #873), #992 (#874), #993 (#935), #994 (#875), #995 (#876). Changesets: #977. Migration issue: #984.

Validation

• .github/dependabot.yml validates against the SchemaStore dependabot-2.0 JSON schema; an unknown update-types value is rejected.
• git merge-tree against main: clean. The series merged in order onto main (chore(repo): run npm Dependabot version updates weekly #873, chore(repo): raise package.json minimums in npm Dependabot updates #874, this, chore(repo): add Dependabot version updates for create-blocks-app templates #875, ci(release): write the changeset for Dependabot bumps at release time #977, chore(repo): retire the weekly ncu dependency update job #876 review-fix branches): no conflicts.
• After merge: the first Dependabot job log shows whether the individual_prs_for_semver_excluded_dependencies experiment is on (Deferring to the update-types rules of group 'dev-dependencies'). If it is, the caveat in the bullet can go.
• Config only, no changeset.

Checklist

• PR description included
• Tests are changed or added (Dependabot config)
• Relevant documentation is changed or added (header comment in dependabot.yml)

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ac06d7a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR