chore: safe Dependabot batch + tighten update policy

.github/dependabot.yml

@@ -1,15 +1,73 @@
-# Update from the repo root so Dependabot rewrites pnpm-lock.yaml together with
-# workspace package.json files. Nested directory entries (e.g. /packages/*) only
-# change manifests and leave --frozen-lockfile CI red on merge.
+# Root-only updates so Dependabot rewrites pnpm-lock.yaml with workspace manifests.
+# Nested package directories cause package.json-only PRs and --frozen-lockfile CI failures.
 version: 2
 updates:
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: weekly
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 5
+    # Prefer intentional upgrades for platform / tooling majors.
+    ignore:
+      - dependency-name: typescript
+        update-types: ['version-update:semver-major']
+      - dependency-name: eslint
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@eslint/js'
+        update-types: ['version-update:semver-major']
+      - dependency-name: expo
+        update-types: ['version-update:semver-major']
+      - dependency-name: react-native
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@react-native/*'
+        update-types: ['version-update:semver-major']
+      - dependency-name: jest
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@types/jest'
+        update-types: ['version-update:semver-major']
+      - dependency-name: babel-jest
+        update-types: ['version-update:semver-major']
+    groups:
+      react:
+        patterns:
+          - 'react'
+          - 'react-dom'
+          - 'react-test-renderer'
+      react-native-tooling:
+        patterns:
+          - 'react-native'
+          - '@react-native/*'
+      eslint-stack:
+        patterns:
+          - 'eslint'
+          - '@eslint/*'
+          - 'eslint-*'
+          - 'typescript-eslint'
+          - 'globals'
+      testing:
+        patterns:
+          - 'jest'
+          - '@types/jest'
+          - 'babel-jest'
+          - '@testing-library/*'
+      babel:
+        patterns:
+          - '@babel/*'
+      typescript:
+        patterns:
+          - 'typescript'
+          - '@types/react'
+      prettier:
+        patterns:
+          - 'prettier'
+          - 'eslint-config-prettier'
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: monthly
+    open-pull-requests-limit: 3
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/ci.yml

@@ -18,13 +18,13 @@ jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Do not set `version` here — package.json `packageManager` already pins pnpm@10.33.0.
-      # Setting both makes pnpm/action-setup@v4 fail with "Multiple versions of pnpm specified".
-      - uses: pnpm/action-setup@v4
+      # Setting both makes pnpm/action-setup fail with "Multiple versions of pnpm specified".
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm
@@ -51,11 +51,11 @@ jobs:
       (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm
@@ -72,7 +72,7 @@ jobs:
       # Avoid Jekyll ignoring paths like _expo on some Pages setups.
       - run: touch apps/example/dist/.nojekyll
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: apps/example/dist
 
@@ -90,4 +90,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

package.json

@@ -40,8 +40,8 @@
     "eslint": "^9.22.0",
     "eslint-config-prettier": "^10.1.1",
     "globals": "^16.0.0",
-    "prettier": "^3.5.3",
-    "typescript-eslint": "^8.26.1"
+    "prettier": "^3.9.4",
+    "typescript-eslint": "^8.62.1"
   },
   "keywords": [
     "react-native-select",