[kikootwo]

What changed

.github/dependabot.yml ignores major versions of vitest and @vitest/* for npm, next to the existing major ignores.

• vitest 5 fails this test suite (chore(deps-dev): bump vitest from 4.0.17 to 5.0.5 in the vitest group #405, chore(deps-dev): bump vitest from 4.1.12 to 5.0.5 in the vitest group across 1 directory #412).
• Closing a grouped Dependabot PR doesn't stop it coming back: chore(deps-dev): bump vitest from 4.1.12 to 5.0.5 in the vitest group across 1 directory #412 reopened minutes after chore(deps-dev): bump vitest from 4.0.17 to 5.0.5 in the vitest group #405 was closed. An ignore is the only way to keep it closed.
• Minor and patch updates for vitest still arrive, in the vitest group, and open alerts still show up (an ignore only stops PRs). Moving to vitest 5 is a hand upgrade when there's a reason to.
• Also corrects the ioredis ignore's comment: Bull uses the same ioredis copy, so ioredis is the job queue's Redis client as well as the startup readiness check.

Checks

• The config parses, and the npm ignore list reads back as prisma, @prisma/, jsdom, @types/node, openid-client, typescript, zod, ioredis, eslint, vitest, @vitest/.
• The PR test suite: pass, and so does the Dependabot config check.
• Tested together with chore(deps-dev): bump jsdom from 27.4.0 to 29.1.1 #414, chore(deps-dev): bump @testing-library/jest-dom from 6.9.1 to 7.0.1 #415 and chore(deps): bump ioredis from 5.8.2 to 5.11.1 in the npm-minor-patch group #413 on main: the full unit suite in the Node 24 test container passes (296 files, 3,952 passed, 5 skipped), and so do the image build, the smoke test and an end-to-end import spec that runs jobs through the queue on real Redis (3/3).

🤖 Generated with Claude Code