chore(deps): update npm dependencies and gate breaking dependabot majors

.github/dependabot.yml

@@ -12,6 +12,14 @@ updates:
     groups:
       dotnet:
         patterns: ["*"]
+    ignore:
+      # NSubstitute 6.0.0 makes Arg.Is<T> take Predicate<T?>, emitting CS8602/
+      # CS8604 across the test suite (upstream nsubstitute/NSubstitute#973,
+      # #976). test/Viper.test.csproj pins 5.3.0 for this reason, and an
+      # ungated major here reverts that pin and fails the whole dotnet group.
+      # Drop this once 6.0.1 ships.
+      - dependency-name: "NSubstitute"
+        update-types: ["version-update:semver-major"]
     open-pull-requests-limit: 5
 
   - package-ecosystem: npm
@@ -44,6 +52,12 @@ updates:
       # once the runtime moves, which is no earlier than Node 26 LTS (2026-10-28).
       - dependency-name: "@types/node"
         update-types: ["version-update:semver-major"]
+      # TypeScript 7 is the native (Go) compiler rewrite. @typescript-eslint 8.x
+      # caps its peer range at "<6.1.0", so TS 7 fails `npm install` with
+      # ERESOLVE and takes the whole grouped PR down with it. Drop this once
+      # typescript-eslint ships a major that declares TS 7 support.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
     open-pull-requests-limit: 5
 
   - package-ecosystem: github-actions