fix(deps): stabilize dependabot auto-merge

Ignore unsupported major dependency upgrades and update stale Dependabot branches before enabling auto-merge.

.github/dependabot.yml

@@ -14,6 +14,13 @@ updates:
       - dependencies
     open-pull-requests-limit: 10
     rebase-strategy: auto
+    ignore:
+      - dependency-name: koa
+        update-types:
+          - version-update:semver-major
+      - dependency-name: "@types/koa"
+        update-types:
+          - version-update:semver-major
     groups:
       production-dependencies:
         dependency-type: production
@@ -40,6 +47,10 @@ updates:
       - dependencies
       - docker
     open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: node
+        update-types:
+          - version-update:semver-major
 
   - package-ecosystem: github-actions
     directory: /

.github/workflows/dependabot-auto-merge.yml

@@ -23,6 +23,16 @@ jobs:
           PR_URL: ${{ github.event.pull_request.html_url }}
         run: gh pr review --repo "$GITHUB_REPOSITORY" "$PR_URL" --approve --body "Approved automatically after policy checks." || true
 
+      - name: Update stale Dependabot branches
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          merge_state="$(gh pr view --repo "$GITHUB_REPOSITORY" "$PR_URL" --json mergeStateStatus --jq .mergeStateStatus)"
+          if [ "$merge_state" = "BEHIND" ]; then
+            gh pr update-branch --repo "$GITHUB_REPOSITORY" "$PR_URL"
+          fi
+
       - name: Enable auto-merge after required checks pass
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}