[ld-ahartmann]

Why

• Dependabot minor and patch bumps sit open waiting for a manual approve and merge.

What

• One new workflow: approves and squash auto-merges Dependabot minor and patch PRs.
• Major bumps and GitHub Actions bumps still need a human.
• Uses pull_request_target without checking out the PR, so no PR code runs with the write token.

Before merging

• A repo admin needs to add build and ci as required checks in ruleset 20792704. Without them, auto-merge can merge a red PR.

Companion: launchdarkly/mcp#219 · Jira: AGNT-428

[ld-ahartmann]

CI note: the ci (dev-server UI) failure on this PR is pre-existing on main and unrelated to this workflow-only change. npm ci fails with ERESOLVE: @launchpad-ui/core@0.59.18 (merged this morning in #891) declares peer react@^19 while the UI is on react@18.3.1.

That is also a live demonstration of why the admin step in this PR description matters: #891 had this same failing ci check, and because ci is not a required status check in the branch-protection-main ruleset, it merged anyway. Once an admin adds build and ci as required checks, auto-merge will hold minor/patch updates until both pass.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5a6bdfb. Configure here.}