From 52fc18f891d9f96cadfd2f3216fe3930583b3001 Mon Sep 17 00:00:00 2001
From: Muhammad Aiman <84276911+aimanmalib@users.noreply.github.com>
Date: Tue, 20 Oct 2026 07:04:57 +0000
Subject: [PATCH] chore(dependabot): leave major upgrades to deliberate PRs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b7ec34f..da2caf6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,11 @@ updates:
     groups:
       npm-minor-patch:
         update-types: [minor, patch]
+    # Major upgrades are done on purpose in their own PR, not by the bot.
+    # Dependabot alerts still report vulnerable versions.
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /