[pashidlos]

release.yml pinned semantic-release, @semantic-release/exec and conventional-changelog-conventionalcommits in an npx -p … line, which Dependabot cannot read. Releases nothing (ci:); safe to merge now.

• A new package.json (private, devDependencies only) holds the same exact pins. release.yml runs npm install --no-package-lock, then npx semantic-release. .releaserc.json is unchanged and sets its plugins explicitly, so no npm plugin is involved.
• No lockfile on purpose. A lockfile of this tooling pulls in semantic-release's bundled npm, and npm audit reports 38 advisories in it (one undici high, 37 moderate). Those would show up as Dependabot alerts that only an upstream release can fix. Without a lockfile, the dependency graph sees just the three direct pins. This matches what the old npx line resolved.
• Dependabot npm entry for /:
  • minor/patch go in one group and security updates in another, limit 5, like the existing entries.
  • Majors of conventional-changelog-conventionalcommits are ignored. Preset 10 needs conventional-changelog-writer 9, and semantic-release 25 bundles writer 8.
• node_modules/ is git-ignored.

Dry run, with the tooling installed from this package.json (semantic-release 25.0.9, exec 7.1.0, preset 9.3.1):

• Setup: a local clone with an extra fix: commit, using --dry-run --no-ci --repository-url file://<bare clone>.
• The github plugin was dropped in that throwaway copy only, because it cannot verify a file:// URL.
• Result: this branch's ci: commit does not trigger a release, and the fix: probe gives 5.1.1. generateNotes ran and produced ### Bug Fixes.

🤖 Generated with Claude Code