fix(dependabot): ungroup msw/vitest majors from auto-merged dev-dependencies

[wyre-agent-fleet]

What

Excludes msw, vitest, and @vitest/* from the auto-merged dev-dependencies Dependabot
group's major bumps. Minor/patch bumps of these packages are unaffected -- they stay
grouped and auto-merged exactly as before, via a second, narrower group.

Why

A grouped Dependabot PR that bundles a msw major bump (2.x -> 3.x) together with a vitest
major bump (4.x -> 5.x) can produce an internally-inconsistent lockfile: npm ci fails with
EUSAGE because the nested msw@2.x subtree that @vitest/mocker's peer dependency still
needs is missing. Dependabot's own version-resolution step doesn't catch this at PR-creation
time, and a casual local npm ci can falsely look clean -- a newer local npm version silently
auto-heals the same gap, so the bug only reproduces reliably against CI's exact npm version in
a clean container.

Confirmed independently across 8 repos during the 2026-10-08 fleet burn-down (rootly-mcp#65,
node-syncro#72, node-it-glue#83, node-threatlocker#34, node-domotz#51, ironscales-mcp#57,
node-halopsa#86, node-datto-saas-protection#57) -- same root cause every time, not an edge case.

Fix

Majors for msw/vitest/@vitest/* now fall through ungrouped into individual PRs, held for
human review -- the same treatment production-dependency majors already get. This stops the
auto-merge-on-green janitor from landing an unverified, potentially-broken lockfile. Minor/patch
updates to these packages remain grouped and auto-merged, so routine PR volume is unaffected.

Config-only change, fleet-wide rollout across the 30 *-mcp/node-* repos confirmed to carry
both msw and vitest as direct devDependencies with this dependabot.yml template. No
application code touched.

Ref: task_1791494841949 (murph)

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Chores
  • Minor and patch updates to the testing tools are now grouped together. Major updates to these tools are handled outside that group.
  • No user-facing changes are included.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4b9b46f5-86ef-41d2-a514-7a9a4149a8f5

📥 Commits

Reviewing files that changed from the base of the PR and between 627c8b2 and 577d50e.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

📝 Walkthrough

Walkthrough

The Dependabot configuration now groups minor and patch updates for msw, vitest, and @vitest/* separately from other npm development dependencies. Major updates for these packages remain outside both groups.

Changes

npm development update groups

Layer / File(s)	Summary
Development update group rules .github/dependabot.yml	The existing development group excludes msw, vitest, and @vitest/*. A separate group includes their minor and patch updates. Major updates for these packages are not included in either group.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Suggested reviewers: asachs01

Merge Risk: ⚪ Minimal · up to 577d5

Major updates to the selected testing dependencies remain individual PRs for review, while minor and patch updates stay grouped. No actionable merge risk was identified.

Architecture Summary

Architecture risk: 🔵 Low · up to 577d5

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/dependabot.yml: The existing development group no longer includes msw, vitest, or @vitest/*; those packages are excluded for all update types. A separate development group now groups them for minor and patch updates only, leaving their major updates outside these groups. Comments describing the grouping and major-update handling were also added.

Pre-merge checks · 5 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Changelog Entry		The PR changes .github/dependabot.yml by altering Dependabot grouping and auto-merge behavior for msw, vitest, and @vitest/*. This is a configuration change. The PR does not modify `CHANGELOG.…	Add a corresponding entry under the Changed section of CHANGELOG.md.

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the Dependabot grouping change and the affected major updates. It matches the pull request objectives.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Changelog Entry

Explanation

The PR changes .github/dependabot.yml by altering Dependabot grouping and auto-merge behavior for msw, vitest, and @vitest/*. This is a configuration change. The PR does not modify CHANGELOG.md or add an entry beneath ## [Unreleased].

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 This PR is included in version 1.0.6 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀