chore: limit Dependabot development updates to minor and patch

[wenyt (wenytang-ms)]

Summary

• Allow ordinary npm development-dependency version updates for minor and patch releases only. Major toolchain migrations should be scheduled and reviewed deliberately rather than arriving as routine dependency bumps.
• Keep production dependency version updates eligible at every semantic version level.
• Preserve automatic security-update eligibility, including for development dependencies: GitHub documents that update-types in allow rules limits version updates only, not security updates.
• Set npm Dependabot commit messages and PR titles to use chore(deps): ... for production dependencies and chore(dev-deps): ... for development dependencies.

Scope

Only .github/dependabot.yml changes. The daily npm schedule, 10-day npm cooldown and Central Feed Service rationale comments remain unchanged. All GitHub Actions settings remain unchanged, including the weekly schedule, grouping and 7-day cooldown.

This PR starts from main and contains no package manifest, lockfile or TypeScript changes and no automerge rules.

Reference

GitHub's Dependabot allow reference supports combining dependency-type with update-types; omitting update-types keeps all version update types eligible for that rule.

GitHub's Dependabot commit-message reference supports separate production and development prefixes for npm and applies them to both commit messages and PR titles.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

The YAML is valid and the Dependabot rules match the stated intent without affecting the existing schedules/cooldowns for npm or GitHub Actions.

Pull request overview

This PR refines the repository’s Dependabot configuration to reduce unplanned major version churn for npm development dependencies, while keeping production dependencies eligible for all semver update types and preserving existing schedules/cooldowns.

Changes:

• Add allow rules to restrict development dependency version updates to minor/patch while leaving production unrestricted.
• Configure npm Dependabot commit/PR title prefixes to distinguish chore(deps) (production) vs chore(dev-deps) (development).

File summaries

File	Description
.github/dependabot.yml	Adds allow-rules to limit dev-dep semver bumps to minor/patch and sets distinct commit-message prefixes for prod vs dev npm updates.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.