[plum117]

What & why

The Auto-merge gate (update.yml, job dependencies) fails on every Dependabot PR (seen since #331, 2026-08-25), so they are all merged by hand.

Cause. CodeQL default setup does not scan PRs opened by Dependabot. Its CodeQL check ends neutral, and the gate allows only success (#449, all other checks green):

CodeQL: completed (neutral)
The conclusion of one or more checks were not allowed. Allowed conclusions are: success.

An alert still ends the CodeQL check as failure, so it still blocks.

	Before	After
allowed-conclusions	success	success,neutral (skipped and cancelled still block)
Update types merged	all npm updates, majors included	npm semver-minor and semver-patch only

update-type from fetch-metadata is the highest update of a group, and empty when unknown, so a group with one major is not merged. Values from the gate logs: #449 (vite 8.3.3) semver-patch, #441 (major group, TypeScript 7) semver-major. GitHub Actions updates (#452) stay manual, as before.

Effect on the current workflow: green minor and patch PRs merge without a person; majors and combined updates stay manual, as today.

Same change as webdriverio/expect-webdriverio#2410 and webdriverio/webdriverio update.yaml. No changeset: CI only.

Type of change

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Polish (an improvement to an existing feature)
• Breaking change (existing behavior changes for users)
• Documentation
• Internal (build, CI, dependencies, tooling)

Packages touched

None: .github/workflows/update.yml only.

Capability matrix

• Not applicable (no user-facing behaviour)

Notes for reviewers

How I tested:

• The workflow parses (Ruby YAML); the if of both steps is the same.
• update-type values above, read from the logs of the gate runs.
• The real proof is the next Dependabot PR after merge.

[plum117]

Let me know if there are any concerns, otherwise that seems straightforward