From 865cfa0e87d74cb59732171f460b229d697bec56 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Wed, 15 Jul 2026 23:49:29 -0300
Subject: [PATCH] =?UTF-8?q?chore(ci):=20stop=20dependabot=20proposing=20ty?=
 =?UTF-8?q?pescript=20majors=20=E2=80=94=20peer-blocked=20by=20typescript-?=
 =?UTF-8?q?eslint=20(#7306)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

typescript-eslint pins a hard upper bound on its typescript peer
(8.64.0 → ">=4.8.4 <6.1.0"). A major TS bump violates it, so the failure is
not one check — it is the whole toolchain at once.

#7068 is the demonstration: dependabot grouped typescript ^6→^7 with six
harmless dev bumps (@types/node, eslint, fast-check, knip, prettier,
typescript-eslint) and turned Build, Lint, Quality Ratchet, Unit (6/8, 8/8),
Integration (1/2, 2/2) and dast-smoke red in a single PR. The six innocuous
updates were blocked by the one that could never pass.

Ignoring the major lets the rest of the group flow on its own. TS majors are a
toolchain migration and deserve their own PR and their own CI run — not a
weekly automated attempt that cannot succeed until typescript-eslint widens the
peer.

Refs #7068
---
 .github/dependabot.yml                                   | 9 +++++++++
 .../7068-dependabot-ignore-typescript-major.md           | 1 +
 2 files changed, 10 insertions(+)
 create mode 100644 changelog.d/maintenance/7068-dependabot-ignore-typescript-major.md

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3c641330f1..0913d78cd0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,6 +24,15 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "eslint-config-next"
         update-types: ["version-update:semver-major"]
+      # typescript majors are peer-blocked by typescript-eslint, which pins a hard
+      # upper bound (8.64.0 → peerDependencies.typescript ">=4.8.4 <6.1.0"). A TS 7
+      # bump therefore violates the peer and takes down the whole toolchain at once —
+      # #7068 grouped it with 6 harmless bumps and turned Build + Lint + Quality Ratchet
+      # + Unit (6/8, 8/8) + Integration (1/2, 2/2) + dast-smoke red in one shot, blocking
+      # the innocuous updates riding along with it. Un-ignore once typescript-eslint
+      # widens the peer, and migrate TS majors intentionally (own PR, own CI run).
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
       # jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API).
       # scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it
       # parses jscpd-report.json against a frozen baseline). A v5 major would break
diff --git a/changelog.d/maintenance/7068-dependabot-ignore-typescript-major.md b/changelog.d/maintenance/7068-dependabot-ignore-typescript-major.md
new file mode 100644
index 0000000000..ae20696c5e
--- /dev/null
+++ b/changelog.d/maintenance/7068-dependabot-ignore-typescript-major.md
@@ -0,0 +1 @@
+- **chore(ci):** stop dependabot from proposing `typescript` majors — `typescript-eslint` pins a hard peer upper bound (`>=4.8.4 <6.1.0`), so a TS 7 bump violates the peer and takes the whole toolchain red at once. #7068 grouped it with 6 harmless dev bumps and blocked all of them. TS majors now migrate intentionally, in their own PR.