[Naturalclar]

Why

@react-native/* and @react-native-community/cli track the react-native minor line, and @types/react tracks react. Dependabot has been proposing each as its own PR, which yields combinations nobody ships — #1244 bumping @react-native/metro-config to 0.88.1 while react-native stays on ^0.81.1 is exactly that.

Grouped rather than ignored. Ignoring these (the original request) would stop the bad PRs but also make RN updates invisible and fully manual. A group keeps the signal and fixes the actual problem: they now arrive as one PR that moves them together, and it costs one slot against open-pull-requests-limit instead of six.

The rule

  groups:
    react-native:
      patterns:
      - react
      - react-native
      - "@react-native/*"
      - "@react-native-community/cli"
      - "@types/react"
      exclude-patterns:
      - react-native-builder-bob
      - react-native-test-app
      - "@rnx-kit/*"
      - "@types/react-native"
      - "@callstack/react-native-visionos"

Why exclude-patterns is not redundant

GitHub's options reference documents * as the wildcard but never states how a pattern without one is matched — exact name or substring. I checked and the docs are genuinely silent on it.

That ambiguity matters here: under a substring reading, bare react would also capture react-native-builder-bob, react-native-test-app, @rnx-kit/metro-config, @types/react-native and @callstack/react-native-visionos — grouping packages that do move independently. @rnx-kit/metro-config is the clearest counter-example: it was bumped on its own in #1242 with CI clean.

Excludes take precedence over patterns, so naming them makes this config behave identically under either interpretation rather than depending on undocumented behaviour.

Verification

I enumerated every entry in devDependencies and confirmed each lands where intended:

• Grouped (6): react, react-native, @react-native/metro-config, @react-native/babel-preset, @react-native-community/cli, @types/react
• Still individual: @biomejs/biome, release-it, @release-it/conventional-changelog, jest, @types/jest, pod-install, typescript, plus the five excluded above

Note that CI does not parse dependabot.yml, so green checks here say nothing about this file. GitHub validates it on push to the default branch; problems appear under Insights → Dependency graph → Dependabot.

Expected follow-on

Once this merges, dependabot should supersede #1241 (react-native 0.88.1), #1244 (@react-native/metro-config 0.88.1) and #1203 (react + @types/react), replacing them with a single grouped PR. That also frees slots against the 10-PR cap.

Not included

release-it and @release-it/conventional-changelog are coupled the same way, and today gave a live demonstration: #1245 (release-it 21.1.2) is unmergeable because the plugin pinned at ^11.0.1 declares peer release-it: ^18 || ^19 || ^20. Grouping those two would prevent a repeat. Left out to keep this PR to the requested scope — happy to add it here or in a follow-up.

🤖 Generated with Claude Code