dependabot: keep peer-locked families in one PR, whatever the bump size

react/react-dom, the vite toolchain, eslint+typescript-eslint+typescript, and
electron (and for cargo: wgpu/egui/eframe/winit, tauri) now each group across
major, minor and patch. Filed above the minor-and-patch group, because
Dependabot puts a dependency in the first group that matches it.

Why: a Dependabot PR bumped react and @types/react to 19 in RFutils and left
react-dom on 18. It was green, it was merged, and the hosted site rendered
only its footer from 2026-08-11 until an outside user reported it on 09-02. A
family arrives together or not at all; when it hits an ecosystem ceiling it
fails as one honest PR instead of three half-applied ones.

No ignore: rules -- an ignore also suppresses the security update.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: stoatworks-labs

.github/dependabot.yml

@@ -23,6 +23,23 @@ updates:
       interval: "weekly"
     open-pull-requests-limit: 5
     groups:
+      # Peer-locked families move together, whatever the bump size. A major that
+      # arrives for one member without the others is how react 19 shipped against
+      # react-dom 18 and took a hosted app down for three weeks (RFutils #22).
+      # These sit ABOVE the minor-and-patch group because Dependabot files a
+      # dependency under the first group that matches it.
+      react-family:
+        patterns: ["react", "react-dom", "@types/react", "@types/react-dom", "react-refresh"]
+        update-types: ["major", "minor", "patch"]
+      vite-toolchain:
+        patterns: ["vite", "@vitejs/*", "vitest", "@vitest/*", "esbuild", "electron-vite", "rolldown", "rolldown-vite"]
+        update-types: ["major", "minor", "patch"]
+      eslint-typescript:
+        patterns: ["eslint", "@eslint/*", "eslint-plugin-*", "eslint-config-*", "typescript-eslint", "@typescript-eslint/*", "typescript"]
+        update-types: ["major", "minor", "patch"]
+      electron-family:
+        patterns: ["electron", "electron-builder", "@electron/*", "@electron-forge/*"]
+        update-types: ["major", "minor", "patch"]
       npm-minor-and-patch:
         patterns: ["*"]
         update-types: ["minor", "patch"]