Hold Repl packages to patch bumps only

[erikdarlingdata]

Holds the Repl packages that arrived with #388 to patch bumps only.

Why this is not just noise control

Repl, Repl.Mcp and Repl.Testing landed at 0.11.0 - pre-1.0, where semver permits a minor bump to break.

The important detail: Dependabot classifies 0.11 -> 0.12 as a minor, and this config groups minor and patch into one batch while giving majors their own PR. So the existing "majors stay separate" protection does nothing here - a breaking Repl bump would arrive folded inside a routine grouped dependency PR, which is exactly the kind of thing that gets merged on a green check.

It matters more than for a typical dependency because Performance Studio ships an auto-updater. Whatever lands reaches users without them choosing to take it.

What it does

Ignores semver-major and semver-minor for all three packages. Patch bumps (0.11.x) still flow, so genuine fixes and any security patches arrive normally. Mirrors the existing ignore rules for the other deliberate pins.

Note

This is independent of whether the Repl pilot itself ships. The packages are on dev either way, and Dependabot now targets dev (fixed in #409), so it would start proposing these on its next scheduled run regardless.

Test plan

• dependabot.yml parses; all nine ignore rules resolve as intended, both ecosystems still target-branch: dev
• Config-only change - no build impact

🤖 Generated with Claude Code

[claude]

Reviewed. Config-only change to .github/dependabot.yml.

Verified the package names match exactly what's referenced in the tree: Repl and Repl.Mcp in src/PlanViewer.Cli/PlanViewer.Cli.csproj, Repl.Testing in tests/PlanViewer.Core.Tests/PlanViewer.Core.Tests.csproj, all at 0.11.0 as the PR states. The three new ignore entries are correctly nested inside the nuget ecosystem block (before the github-actions block starts), and follow the same shape as the existing Avalonia*/Microsoft.VisualStudio.SDK major-only pins, just extended to also ignore semver-minor — consistent with the stated pre-1.0 rationale. YAML indentation and structure look correct.

No correctness, security, or repo-convention issues here — this doesn't touch app code, T-SQL generation, or plan-XML parsing. LGTM.