[DealAppSeo]

Config only. Minor and patch bumps were already grouped; this adds the ignore block the other repos carry (trustshell #513, trinity-symphony-shared #71, repid-engine #1311), so the reviewed majors are not re-raised once their PRs are closed.

Ignored major	Open PRs it covers	Why
typescript 5 → 7	#42, #46, #48, #49	TypeScript 7 is the native-compiler rewrite. Not in a published-SDK repo ahead of a release.
@types/node 22 → 26	#43, #47	CI runs Node 22.
nx 22 → 23	#44	Major toolchain bump, no driver.
dotenv 17 → 18	#45, #50	Major, no driver.

#46, #47 and #50 also fail clean install from lockfile and contracts tests. They bump packages/contracts/package.json and its nested lockfile but not the root package-lock.json, so npm ci at the root fails. Those are real failures, but they are moot once the majors are closed.

Delete an ignore entry when the repo is ready to take that major. github-actions has no ignores.

🤖 Generated with Claude Code

[strix-security]

Strix Security Review

No security issues found.

Review summary

Reviewed the single changed file, .github/dependabot.yml. The PR adds a Dependabot ignore block that suppresses version-update:semver-major PRs for four npm packages (typescript, @types/node, nx, dotenv), each justified in the PR description (native-compiler rewrite, CI/runtime version alignment, and un-drivered major bumps). This is a build/CI configuration change with no effect on application runtime behavior. It neither introduces nor removes a security control: the ignore rules apply only to Dependabot's version updates, not to its separate security/advisory update mechanism, and github-actions remains unignored. No injection, auth, secret, deserialization, path traversal, SSRF, XSS, crypto, race-condition, data-exposure, mass-assignment, IDOR, open-redirect, ReDoS, or prototype-pollution surface is touched. No security issues found.

_{Updated for 946a0f9.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}