chore: keep major Dependabot updates out of grouped PRs

[ascorbic]

What does this PR do?

Restricts the Dependabot dev-dependencies and production-dependencies groups to minor and patch bumps. Major updates now break out into their own individual PRs instead of being batched in.

The first grouped PR (#1262) failed all build-dependent checks because Dependabot lumped a major @vitejs/plugin-react bump (4 -> 6) in with ~18 safe minor/patch updates. @vitejs/plugin-react@6 imports vite/internal, a subpath our pinned Vite 8 (rolldown-vite) doesn't export, so vite build died and took the whole batch down with it.

Isolating majors keeps the safe minor/patch updates flowing as a single low-noise PR, while breaking changes land individually where they can be reviewed (or closed) on their own. We can pick up the Vite-ecosystem majors when Astro bumps its Vite peer.

Type of change

• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: Claude Opus 4.8 (opencode)

---

Try this PR

Open a fresh playground →

A full working EmDash site, deployed from this branch. Each visit gets its own session-scoped sandbox: no login needed and no shared state. Try the admin, edit content, hit the public site.

_{Tracks chore/dependabot-separate-majors. Updated automatically when the playground redeploys.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4d00173

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

PR template validation failed

Please fix the following issues by editing your PR description:

• Check the "I have read CONTRIBUTING.md" checkbox.

See CONTRIBUTING.md for the full contribution policy.

[Copilot]

Pull request overview

Updates Dependabot grouping rules so major version bumps are no longer included in the grouped dev-dependencies / production-dependencies PRs, reducing the chance that a single breaking change causes an entire batch PR to fail CI.

Changes:

• Restrict dev-dependencies group to minor and patch updates only.
• Restrict production-dependencies group to minor and patch updates only.
• Add inline rationale comment explaining why majors should not be grouped.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[emdashbot]

This is a focused, correct configuration change that solves the stated problem. The approach is sound: by restricting Dependabot groups to minor and patch bumps, major version updates (which carry breaking changes and peer-dep incompatibilities — like the @vitejs/plugin-react@6 incident described in the PR) will now be raised as individual PRs for separate review instead of poisoning an otherwise safe grouped batch.

I checked the full dependabot.yml and AGENTS.md conventions. The update-types syntax matches GitHub's Dependabot schema, and no code-level conventions (SQL safety, Lingui, RTL, authorization, etc.) apply to a CI-only tooling tweak. No changeset is required per CONTRIBUTING.md for CI/tooling changes.

The existing cooldown.semver-major-days: 7 already delays major bumps, which pairs well with the new grouping exclusion — safe updates flow as a single low-noise grouped PR, while majors land individually after their cooldown. Clean PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	docs	4d00173	Jun 01 2026, 02:40 PM

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@1264

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@1264

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/@emdash-cms/auth-atproto@1264

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@1264

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@1264

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/contentful-to-portable-text@1264

emdash

npm i https://pkg.pr.new/emdash@1264

create-emdash

npm i https://pkg.pr.new/create-emdash@1264

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@1264

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/@emdash-cms/plugin-cli@1264

@emdash-cms/plugin-types

npm i https://pkg.pr.new/@emdash-cms/plugin-types@1264

@emdash-cms/registry-client

npm i https://pkg.pr.new/@emdash-cms/registry-client@1264

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/@emdash-cms/registry-lexicons@1264

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/@emdash-cms/sandbox-workerd@1264

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@1264

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@1264

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@1264

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@1264

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@1264

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@1264

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/@emdash-cms/plugin-field-kit@1264

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@1264

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@1264

commit: 4d00173

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-cache	4d00173	Jun 01 2026, 02:41 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-playground	4d00173	Jun 01 2026, 02:41 PM