[wyre-agent-fleet]

What

Excludes msw, vitest, and @vitest/* from the auto-merged dev-dependencies Dependabot
group's major bumps. Minor/patch bumps of these packages are unaffected -- they stay
grouped and auto-merged exactly as before, via a second, narrower group.

Why

A grouped Dependabot PR that bundles a msw major bump (2.x -> 3.x) together with a vitest
major bump (4.x -> 5.x) can produce an internally-inconsistent lockfile: npm ci fails with
EUSAGE because the nested msw@2.x subtree that @vitest/mocker's peer dependency still
needs is missing. Dependabot's own version-resolution step doesn't catch this at PR-creation
time, and a casual local npm ci can falsely look clean -- a newer local npm version silently
auto-heals the same gap, so the bug only reproduces reliably against CI's exact npm version in
a clean container.

Confirmed independently across 8 repos during the 2026-10-08 fleet burn-down (rootly-mcp#65,
node-syncro#72, node-it-glue#83, node-threatlocker#34, node-domotz#51, ironscales-mcp#57,
node-halopsa#86, node-datto-saas-protection#57) -- same root cause every time, not an edge case.

Fix

Majors for msw/vitest/@vitest/* now fall through ungrouped into individual PRs, held for
human review -- the same treatment production-dependency majors already get. This stops the
auto-merge-on-green janitor from landing an unverified, potentially-broken lockfile. Minor/patch
updates to these packages remain grouped and auto-merged, so routine PR volume is unaffected.

Config-only change, fleet-wide rollout across the 30 *-mcp/node-* repos confirmed to carry
both msw and vitest as direct devDependencies with this dependabot.yml template. No
application code touched.

Ref: task_1791494841949 (murph)

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Chores
  • Development dependency updates for MSW and Vitest now group minor and patch releases together, while major releases are proposed individually. Major updates for other development dependencies remain grouped.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1c22b361-48df-466a-a9e3-ebd3b03b0966

📥 Commits

Reviewing files that changed from the base of the PR and between 0b1a60b and 5a9081f.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

📝 Walkthrough

Walkthrough

The Dependabot configuration excludes msw, vitest, and @vitest/* from the general development dependency group. A separate group covers minor and patch updates for these dependencies.

Changes

Development dependency update groups

Layer / File(s)	Summary
Development dependency grouping rules .github/dependabot.yml	The dev-dependencies group excludes msw, vitest, and @vitest/*. A new group includes their minor and patch updates. Their major updates are no longer included in either group. Other development dependency majors remain grouped.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: asachs01

Merge Risk: ⚪ Minimal · up to 5a908

This configuration-only change keeps msw and vitest major updates out of the auto-merged group so they get individual PRs for human review. Minor and patch updates stay grouped. No concrete merge-blocking risk was found.

Architecture Summary

Architecture risk: 🔵 Low · up to 5a908

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/dependabot.yml: The dev-dependencies group still includes major, minor, and patch updates, but now excludes msw, vitest, and @vitest/*. Their major updates therefore no longer use this grouped path.
• observed — Modified behavior in .github/dependabot.yml: Adds a development-dependency group for minor and patch updates to msw, vitest, and @vitest/*; their major updates are not included.

Pre-merge checks · 5 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Changelog Entry		The PR changes .github/dependabot.yml and alters dependency-update configuration: major updates for msw, vitest, and @vitest/* are no longer grouped. The root CHANGELOG.md exists, but the PR…	Add a corresponding entry beneath ## [Unreleased] in the Changed section of CHANGELOG.md for the Dependabot grouping change.

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: major updates for msw and Vitest are removed from the grouped, auto-merged Dependabot updates.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Changelog Entry

Explanation

The PR changes .github/dependabot.yml and alters dependency-update configuration: major updates for msw, vitest, and @vitest/* are no longer grouped. The root CHANGELOG.md exists, but the PR does not edit it and contains no ## [Unreleased] entry. This is a configuration change under the check criteria.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}