Keep pm packages in the pm-toolchain Dependabot group
What
dependencies group now has exclude-patterns: ["@unbrained/pm-cli", "pm-*"], so it is disjoint from pm-toolchain.
Why
After #118 merged, Dependabot regrouped the open updates into #119 and put pm-ops (2026.9.28 → 2026.9.29) into the generic dependencies group instead of pm-toolchain. pm packages must move together (pm-ops's newer releases expect a newer @unbrained/pm-cli), so they may only ever be bumped in pm-toolchain.
Evidence that #118 works
- #119 was opened by Dependabot and
dependabot-auto-mergeenabled squash auto-merge on it (run succeeded ondependabot/npm_and_yarn/dependencies-852671bb2a). - One red run is a benign race: Dependabot closed #112 as superseded while the job was enabling auto-merge on it.
pm item
- pm-v1it — closed here with the evidence above.
Summary by Sourcery
Keep pm packages synchronized by making Dependabot groups disjoint and tightening automatic merge eligibility for other dependency updates.
Enhancements:
- Keep pm-toolchain packages exclusively in their dedicated Dependabot group so they are updated together.
- Restrict automatic merging of non-pm-toolchain Dependabot updates to minor and patch releases, leaving major or unclassified updates for manual review.
CI:
- Grant the Dependabot auto-merge workflow the permissions required to enable squash auto-merge.
Summary by cubic
Keeps pm packages out of the generic dependencies Dependabot group so they can only be bumped together in pm-toolchain.
After #118, Dependabot routed pm-ops into dependencies, where it was capped at 2026.9.29 instead of moving in sync with new @unbrained/pm-cli releases. The dependencies group now explicitly selects every npm package except the pm-toolchain patterns (@unbrained/pm-cli, pm-*), making the two groups disjoint. The auto-merge workflow also now requires updates outside pm-toolchain to be explicitly classified as minor or patch, so an unclassified or major update waits for a person.