[jokerttu]

Groups Dependabot updates by update type so that one update needing a migration no longer blocks every other update in the same ecosystem.

Each ecosystem used a single group matching every dependency, so all updates landed in one pull request. When any of them needed a migration, the whole pull request could not be merged: #690 combined 31 package changes, including React Native 0.88, TypeScript 7, ESLint 10, and Babel 8, and had to be split by hand in #703.

Changes

npm

• A react-native group (react-native, @react-native/*, react, react-test-renderer) keeps React Native upgrades in one pull request. React Native 0.x releases are minor updates for Dependabot, and React must match the renderer React Native ships. The group is listed first because a dependency is included in the first group it matches.
• npm-dependencies covers only minor and patch updates. Major updates match no group, so Dependabot opens one pull request per update.
• typescript is excluded from npm-dependencies: a TypeScript minor release can exceed the range @typescript-eslint supports (<6.1.0).

Gradle

• android-dependencies and example-android-dependencies cover only minor and patch updates; major updates such as Guava 33 arrive as their own pull requests.
• Minor and major gradle-wrapper updates in example/android are ignored. The wrapper version follows React Native's template and changes with React Native upgrades; Gradle 9.8.2 bundles Kotlin 2.4 metadata that React Native's Gradle plugin cannot read. Patch updates are still grouped.

All three

• open-pull-requests-limit goes from 3 to 10. Major update pull requests may stay open until their migration is done, and they count toward the limit, which would otherwise stop the grouped pull request from opening.

GitHub Actions is unchanged.

Effect

Before	After
One npm pull request with every update	A minor and patch pull request, a React Native pull request, a TypeScript pull request, and one pull request per major update
Example Gradle group blocked by the wrapper	Kotlin, ktfmt, and AndroidX updates grouped; wrapper minor and major updates ignored

Security update pull requests are unaffected; they have a separate, fixed limit of 10.

Pre-launch Checklist

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
• I signed the CLA.
• I listed at least one issue that this PR fixes in the description above.
• I updated/added relevant documentation
• I added new tests to check the change I am making
• All existing and new tests are passing.