[Naturalclar]

Replaces #1247, which GitHub closed when its base branch was deleted during the merge of #1246. The file content here is byte-identical to what was reviewed there — only the base differs (master instead of the stacked branch).

Why

release-it and @release-it/conventional-changelog are coupled through a peer range. The plugin at ^11.0.1 declares:

"peerDependencies": { "release-it": "^18.0.0 || ^19.0.0 || ^20.0.0" }

So bumping release-it alone past 20 produces a combination the plugin refuses.

This is not hypothetical — it is the current state of the repo. #1245 bumps release-it 18.1.2 → 21.1.2 on its own and is unmergeable for precisely this reason.

What makes it worth a config rule rather than a one-off fix is that nothing catches it:

• yarn treats a peer-dependency mismatch as a warning, not an error, so yarn install --immutable passes
• no CI job runs the release path — the Build workflow is lint, tsc, android, ios
• so the breakage would first surface on a real publish attempt

I verified the peer range against the published tarball rather than reading changelogs.

The rule

    release-it:
      patterns:
      - release-it
      - "@release-it/*"

No exclude-patterns, unlike the react-native group in #1246. release-it and @release-it/conventional-changelog are the only dependencies either pattern can match, so the group is identical whether non-wildcard patterns match exactly or by substring — the ambiguity that made excludes necessary there has no effect here.

Verification

• Group resolves to exactly release-it + @release-it/conventional-changelog
• Both react-native and release-it parse as sibling groups
• open-pull-requests-limit retained, no ignore block reintroduced
• Resulting file confirmed byte-identical to the version reviewed in chore: group release-it with its changelog plugin in dependabot #1247

As with #1246 and #1237: CI does not parse dependabot.yml, so green checks here are not evidence about this file. GitHub validates it on push to the default branch (Insights → Dependency graph → Dependabot).

Follow-on

Dependabot should supersede #1245 with a grouped PR moving release-it and the plugin together — likely release-it 21 with plugin 12.x, which supports it. That grouped bump will also need .tool-versions raised: release-it 21 requires Node ^22.22.2 || ^24.15.0 || >=26.0.0 and the repo pins nodejs 22.11.0. Separate change, not part of this PR.

🤖 Generated with Claude Code