Requirements

• I have added test coverage for new or changed functionality (existing suite validates the build/runtime; this change is dev-tooling + config only)
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Replaces the currently open Dependabot PRs (#374, #377, #388, #392, #393, #394), all of which are major-version bumps.

Describe the solution you've provided

This consolidates dependency maintenance into a single, tested PR and codifies a safer Dependabot policy.

1. Dependency update (package.json) — bumps the esbuild devDependency ^0.24.0 → ^0.28.1 to resolve the moderate advisory GHSA-67mh-4wv8-2f99 (esbuild <=0.24.2 dev server request). npm audit now reports 0 vulnerabilities. esbuild 0.28.1 was released 2026-06-11 (~25 days ago), satisfying a 7-day quarantine. This is the only actionable update under the new same-major policy: npm outdated shows every other outstanding update is a major bump with no security justification, and everything else is already at the latest version within its current major.

2. Dependabot policy (.github/dependabot.yml) — for both the npm and github-actions ecosystems:

   • cooldown: { default-days: 7 } enforces the dependency quarantine (only adopt releases ≥7 days old) going forward.
   • ignore on dependency-name: "*" with update-types: ["version-update:semver-major"] restricts version-update PRs to the current major. Per GitHub's docs, update-types does not affect security updates, so Dependabot will still open a major-version PR when required to resolve a vulnerability.

Validated locally: npm run build, npm run lint, tsc, and the full jest suite (93 tests) all pass, and npm audit is clean.

Describe alternatives you've considered

• Adopting the open React 19 devDependency bumps (react, react-dom, react-test-renderer and their @types) and actions/setup-node v6. These are all major bumps with no security driver, so they are intentionally excluded under the new same-major policy. They can be pursued separately as deliberate, tested major upgrades if desired.
• A global semver-major ignore alone (without noting the security exemption): documented behavior confirms security updates are unaffected by update-types, so the security-major path remains open.

Additional context

The 7-day quarantine and same-major restriction reduce exposure to supply-chain risk from freshly published or major releases while keeping security fixes flowing.

Link to Devin session: https://app.devin.ai/sessions/9a6e6afb929646c3b9d14c4f13a17601
Requested by: @kinyoklion