feat!: upgrade WordPress packages to latest

.github/dependabot.yml

@@ -14,6 +14,53 @@ updates:
     # Add reviewers
     reviewers:
       - 'Automattic/newspack-product'
+    # Group minor and patch updates by ecosystem to reduce PR volume.
+    # Major updates are intentionally left ungrouped so each one gets its own
+    # PR for proper review (e.g. eslint 8 → 9 needs careful handling).
+    groups:
+      wordpress:
+        patterns:
+          - '@wordpress/*'
+        update-types:
+          - 'minor'
+          - 'patch'
+      eslint:
+        patterns:
+          - 'eslint'
+          - 'eslint-*'
+          - '@typescript-eslint/*'
+          - '@rushstack/eslint-patch'
+        update-types:
+          - 'minor'
+          - 'patch'
+      testing:
+        patterns:
+          - '@testing-library/*'
+        update-types:
+          - 'minor'
+          - 'patch'
+      semantic-release:
+        patterns:
+          - 'semantic-release'
+          - 'semantic-release-*'
+          - '@semantic-release/*'
+        update-types:
+          - 'minor'
+          - 'patch'
+      commitlint:
+        patterns:
+          - '@commitlint/*'
+          - 'commitizen'
+          - 'cz-conventional-changelog'
+        update-types:
+          - 'minor'
+          - 'patch'
+      types:
+        patterns:
+          - '@types/*'
+        update-types:
+          - 'minor'
+          - 'patch'
 
   # Enable version updates for Composer
   - package-ecosystem: 'composer'

.github/workflows/auto-merge.yml

@@ -5,14 +5,17 @@ on:
 name: Dependabot auto-merge
 jobs:
   auto-merge:
-    name: Auto-merge dependabot PRs for minor and patch updates
+    name: Auto-merge dependabot PRs for patch updates
     runs-on: ubuntu-latest
     if: |
       contains( github.event.pull_request.labels.*.name, 'dependencies' )
       && ! contains( github.event.pull_request.labels.*.name, '[Status] Approved' )
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - uses: ahmadnassri/action-dependabot-auto-merge@v2
         with:
-          target: minor # includes patch updates.
+          # Limited to `patch` because grouped Dependabot PRs (see dependabot.yml)
+          # can bundle many minor updates at once — broader auto-merge would
+          # increase blast radius. Minor updates require manual review.
+          target: patch
           github-token: ${{ secrets.DEPENDABOT_TOKEN }}