chore: ignore major workers-types updates in Dependabot

[NuroDev]

Prevent Dependabot from opening no-op major updates for @cloudflare/workers-types.

@prisma/adapter-d1 still depends on workers-types v4. Dependabot detects that transitive lockfile entry and repeatedly attempts a v4-to-v5 update, but only produces unrelated lockfile churn. Ignore semver-major workers-types updates while retaining minor and patch updates for the repository's v5 dependency.

Example: #15030

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because: this only changes Dependabot configuration, and pnpm check:workflows passes.
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: this is an internal dependency automation change with no user-facing behavior.

A picture of a cute animal (not mandatory, but encouraged)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9b13e57

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ask-bonk]

The change is a small, well-scoped Dependabot config change. It adds an ignore block preventing major version updates for @cloudflare/workers-types, with a clear explanatory comment. The YAML syntax is correct and consistent with the existing config structure. There are no logic bugs, security issues, or backward compatibility concerns.

LGTM

github run

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@15056

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@15056

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@15056

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@15056

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@15056

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@15056

miniflare

npm i https://pkg.pr.new/miniflare@15056

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@15056

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@15056

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@15056

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@15056

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@15056

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@15056

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@15056

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@15056

wrangler

npm i https://pkg.pr.new/wrangler@15056

commit: 9b13e57

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

Show detailed file reviewers

• .github/dependabot.yml: [@cloudflare/wrangler]

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[petebacondarwin]

There are also

• partyserver: https://github.com/cloudflare/workers-sdk/blob/main/pnpm-lock.yaml#L13496-L13499
• A wrangler@4.76: https://github.com/cloudflare/workers-sdk/blob/main/pnpm-lock.yaml#L15888C1-L15896C23

But is this the right solution?
The example dependabot bump just tweaked a few package-lock lines but didn't actually try to bump the version of workers-types.

Are you saying that even if we landed that PR it would appear again the following week?