fix: resolve remaining dependabot alerts and renovate automerge

.github/copilot-instructions.md

@@ -66,6 +66,8 @@ Example-specific deps (e.g. `styled-components`, `glamor`, `react-frame-componen
 
 Do not bump vite, @vitejs/plugin-react, next, or typescript in examples beyond the versions in the reference templates.
 
+Exception: patch-level bumps within the template's major.minor are allowed to clear security advisories, for example `next` 15.5.7 to 15.5.22. Do not cross a minor or major boundary.
+
 ## Conventions
 
 - PropTypes and TypeScript types are maintained in parallel: update both when changing props.

examples/ssr/package.json

@@ -13,7 +13,7 @@
     "lint": "next lint"
   },
   "dependencies": {
-    "next": "15.5.10",
+    "next": "15.5.22",
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "react-spinners": "0.17.0",

package.json

@@ -63,10 +63,10 @@
     "prop-types": "^15.8.1"
   },
   "devDependencies": {
-    "@babel/core": "7.29.0",
-    "@babel/plugin-transform-runtime": "7.29.0",
-    "@babel/preset-env": "7.29.0",
-    "@babel/preset-react": "7.28.5",
+    "@babel/core": "7.29.7",
+    "@babel/plugin-transform-runtime": "7.29.7",
+    "@babel/preset-env": "7.29.7",
+    "@babel/preset-react": "7.29.7",
     "@eslint-react/eslint-plugin": "5.18.0",
     "@eslint/js": "10.0.1",
     "@faker-js/faker": "10.3.0",

renovate.json

@@ -16,7 +16,8 @@
     "**/examples/**"
   ],
   "lockFileMaintenance": {
-    "enabled": true
+    "enabled": true,
+    "minimumReleaseAge": null
   },
   "minimumReleaseAge": "3 days",
   "packageRules": [
@@ -32,6 +33,18 @@
       ],
       "allowedVersions": "< 14.0.0"
     },
+    {
+      "automerge": false,
+      "groupName": "eslint",
+      "matchPackageNames": [
+        "eslint",
+        "@eslint/**",
+        "@eslint-react/**",
+        "typescript-eslint",
+        "eslint-plugin-**",
+        "eslint-config-**"
+      ]
+    },
     {
       "automerge": false,
       "groupName": "react monorepo",