From 577d50eecc79f6c8ebf91e28570c05d3a865b104 Mon Sep 17 00:00:00 2001
From: "wyre-agent-fleet[bot]"
 <305944668+wyre-agent-fleet[bot]@users.noreply.github.com>
Date: Tue, 13 Oct 2026 00:42:33 +0000
Subject: [PATCH] fix(dependabot): ungroup msw/vitest majors from auto-merged
 dev-dependencies

---
 .github/dependabot.yml | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8555bf5..b0d879d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,11 +18,32 @@ updates:
       prefix-development: "deps-dev"
       include: "scope"
     groups:
-      # All dev/CI tooling (eslint, vitest, typescript, @types/*, etc.) incl.
-      # majors → ONE PR. The janitor auto-merges it when CI is green.
+      # All dev/CI tooling (eslint, typescript, @types/*, etc.) incl. majors ->
+      # ONE PR. The janitor auto-merges it when CI is green.
+      # msw + vitest EXCLUDED here (2026-10-13, task_1791494841949) -- a
+      # grouped msw+vitest MAJOR bump (e.g. msw 2.x->3.x + vitest 4.x->5.x)
+      # produces an internally-inconsistent lockfile that Dependabot's own
+      # version-resolution doesn't catch (npm ci EUSAGE; a newer local npm
+      # silently auto-heals the gap, so a casual local check false-passes --
+      # only reproduces against CI's exact npm version). Confirmed across 8
+      # repos in burn-down round 2. Their MAJORS now fall through ungrouped
+      # -> individual PRs, held for human review, same as production majors
+      # below. Minor/patch bumps are unaffected -- see the group below.
       dev-dependencies:
         dependency-type: "development"
         update-types: ["major", "minor", "patch"]
+        exclude-patterns:
+          - "msw"
+          - "vitest"
+          - "@vitest/*"
+      # msw/vitest minor+patch stay grouped+auto-merged like any other dev dep.
+      dev-dependencies-msw-vitest-minor-patch:
+        dependency-type: "development"
+        update-types: ["minor", "patch"]
+        patterns:
+          - "msw"
+          - "vitest"
+          - "@vitest/*"
       # Production minor + patch → ONE PR. Auto-merged when green.
       production-minor-patch:
         dependency-type: "production"