[Naturalclar]

Stacked on #1246 — based on that branch so the diff here is only the new group. GitHub will retarget this to master automatically once #1246 merges.

Why

release-it and @release-it/conventional-changelog are coupled through a peer range. The plugin at ^11.0.1 declares:

"peerDependencies": { "release-it": "^18.0.0 || ^19.0.0 || ^20.0.0" }

So bumping release-it alone past 20 produces a combination the plugin refuses.

This is not hypothetical — it is the current state of the repo. #1245 bumps release-it 18.1.2 → 21.1.2 on its own and is unmergeable for precisely this reason.

What makes it worth a config rule rather than a one-off fix is that nothing catches it:

• yarn treats a peer-dependency mismatch as a warning, not an error, so yarn install --immutable passes
• no CI job runs the release path at all — the Build workflow is lint, tsc, android, ios
• so the breakage would first appear on a real publish attempt

I verified the peer range against the published tarball rather than reading changelogs.

The rule

    release-it:
      patterns:
      - release-it
      - "@release-it/*"

No exclude-patterns here, unlike the react-native group. release-it and @release-it/conventional-changelog are the only dependencies either pattern can match, so the group is identical whether non-wildcard patterns match exactly or by substring — the ambiguity that made excludes necessary in #1246 has no effect here.

Verification

• Group resolves to exactly release-it + @release-it/conventional-changelog
• Both groups parse as siblings under groups:
• Remaining individual-PR packages unchanged: @biomejs/biome, jest, @types/jest, pod-install, typescript, plus the five excluded from the RN group

As with #1246 and #1237: CI does not parse dependabot.yml, so green checks here are not evidence about this file. GitHub validates it on push to the default branch (Insights → Dependency graph → Dependabot).

Follow-on

Once this is in, dependabot should supersede #1245 with a grouped PR moving release-it and the plugin together — likely release-it 21 with plugin 12.x, which does support it. Note that a grouped bump to release-it 21 will also need .tool-versions raised: release-it 21 requires Node ^22.22.2 || ^24.15.0 || >=26.0.0 and the repo pins nodejs 22.11.0. That is a separate change and not part of this PR.

🤖 Generated with Claude Code