[planadecu]

What

• ci.yml passes the PR author (PR_AUTHOR) to scripts/check-changelog-heading.mjs.
• For PRs authored by dependabot[bot], the script skips the "version greater than base" and release-notes checks. The CHANGELOG heading check still runs.
• Docs: CONTRIBUTING.md ("Dependabot PRs") and CLAUDE.md describe the exception.
• pnpm-workspace.yaml overrides source-map-js to ^1.2.2 (GHSA-68fv-2mgg-jv7q, Dependabot alert Clearing metric selection does not invalidate pending data requests #27). Dependabot's security update failed (security_update_not_possible: latest resolvable 1.2.1) because it couldn't move this transitive dev dependency (vitest > vite > postcss) in the pnpm lockfile; this follows the existing postcss/nanoid security floors.
• Version 0.2.5.

Why

Dependabot can't bump package.json or write CHANGELOG entries, so each of its PRs failed test (22) / test (24) until someone pushed a bump by hand (e.g. #34). Its updates now merge without publishing (publish.yml skips a version already on npm) and ship with the next release.

The exemption uses the PR author, not the branch name: anyone can push a dependabot/... branch, but only Dependabot opens PRs as dependabot[bot].

Verification

• New tests in test/release-scripts.spec.ts: Dependabot may keep the base version; other authors (including a plain dependabot login) still must bump; the heading check still applies to Dependabot.
• pnpm test (113 passed), pnpm run build, and the heading check run locally with and without PR_AUTHOR=dependabot[bot].

Impact

No change for human PRs. After merge, #34 can drop its manual bump and rely on the exemption.

[planadecu]

Superseded. The version rule now lives in #35: a change needs a new version only when what users install changes (src/, tsconfig.json, LICENSE, NOTICE, and package.json apart from devDependencies). Dependabot is split into runtime and development PRs: development ones pass as opened, runtime ones get a version bump before merging. The source-map-js fix moved to #38.