chore(deps): ignore TypeScript major bumps + drop unused pbf direct dep

[Yeraze]

Two small dependency-hygiene changes.

1. Dependabot: ignore TypeScript major-version bumps

Adds an ignore entry to the root npm ecosystem block so Dependabot stops
proposing TypeScript major updates.

Why: TypeScript 7 ships a native (Go) compiler package that drops the
JS compiler API @typescript-eslint depends on. A TS7 major bump breaks
lint:ci today even though our own code is already TS7-clean. This follows
the hold on Dependabot PR #4086 and the review discussion in #4091 — we
hold major bumps until the tooling ecosystem ships TS7-native support.
Minor/patch TS updates are unaffected.

2. Remove unused pbf / @types/pbf direct dependencies

Nothing in src/ or desktop/ imports the pbf module — the only .pbf
references are the vector-tile file-extension string, which is unrelated.
The real consumers are transitive under maplibre-gl
(@mapbox/vector-tile, @maplibre/vt-pbf, maplibre-gl), which pin their
own nested pbf@4.x and are unaffected.

Removing the top-level dep only drops the (unused) dedup entry. Verified the
regenerated package-lock.json still contains nested pbf@4.0.2 under the
maplibre tree, so vector-tile decoding is intact. (Notably the old top-level
pbf@5.1.2 wasn't even satisfying maplibre's 4.x requirement, confirming
it was dead weight.)

Verification

• npm run typecheck — clean
• npm run build — succeeds
• Full Vitest suite — 3157 suites / 10414 tests, 0 failures (map/tile suites
  BaseMap + VectorTileLayer included)

🤖 Generated with Claude Code

[github-actions]

Claude finished @Yeraze's task —— View job

---

PR Review: chore(deps): ignore TypeScript major bumps + drop unused pbf direct dep

• Gather context and read changed files
• Review .github/dependabot.yml changes
• Review package.json / package-lock.json changes
• Final assessment

---

Review Summary

This is a clean dependency-hygiene PR. Both changes are well-reasoned and correctly implemented.

1. Dependabot: Ignore TypeScript major bumps (.github/dependabot.yml)

The ignore entry is correct Dependabot v2 syntax:

ignore:
  - dependency-name: "typescript"
    update-types: ["version-update:semver-major"]

Observations:

• The ignore block is correctly placed inside the npm ecosystem block (lines 17–22), scoping it only to npm — Actions and Docker are unaffected. ✅
• version-update:semver-major is the correct value to suppress only major bumps while still allowing minor/patch updates. ✅
• The inline comment clearly documents the why (TS7 drops the JS compiler API that @typescript-eslint depends on), which is important for future maintainers. ✅
• One minor note: the typescript package is in devDependencies, but that doesn't affect Dependabot behavior — the ignore applies package-name-wide regardless. This is fine.

2. Remove unused pbf / @types/pbf (package.json, package-lock.json)

Observations:

• Verified: all pbf references in src/ are file-extension strings (.pbf in URL paths), not import 'pbf' statements. The package was genuinely unused. ✅
• The PR description correctly identifies the transitive consumers (@mapbox/vector-tile, @maplibre/vt-pbf, maplibre-gl) as separate from the top-level direct dep. ✅
• The old top-level pbf@5.1.2 wasn't even satisfying maplibre-gl's ^4.x requirement, which doubly confirms it was dead weight. ✅
• package-lock.json diff shows only the removal of the top-level dedup entry; the nested pbf@4.x under the maplibre tree remains intact. ✅

Minor Suggestions (non-blocking)

None — the changes are minimal, focused, and well-verified per the PR description (typecheck + build + full Vitest suite passing).

---

Verdict: LGTM. Both changes are safe, correct, and well-documented. Ready to merge.