[ld-ahartmann]

Why

Dependabot minor and patch bumps sit open until someone approves and merges them by hand, so this PR adds a workflow that does that automatically.

Summary

• Adds .github/workflows/dependabot-auto-merge.yml: on Dependabot PRs it approves and turns on squash auto-merge (GitHub merges the PR once its required checks pass).
• Major version bumps and GitHub Actions bumps are skipped and still need a human.
• Uses pull_request_target (runs with a write token) but never checks out PR code, so no PR code runs with that token.
• Before merging, a repo admin must add build and ci as required checks in ruleset 20792704. Today main requires only the bot-oversight check, so auto-merge could merge a red PR.

Verification

• build, ci and the .github/dependabot.yml check passed on this PR.

Flags

None new.

Companion: launchdarkly/mcp#219 · AGNT-428

[ld-ahartmann]

CI note: the ci (dev-server UI) failure on this PR is pre-existing on main and unrelated to this workflow-only change. npm ci fails with ERESOLVE: @launchpad-ui/core@0.59.18 (merged this morning in #891) declares peer react@^19 while the UI is on react@18.3.1.

That is also a live demonstration of why the admin step in this PR description matters: #891 had this same failing ci check, and because ci is not a required status check in the branch-protection-main ruleset, it merged anyway. Once an admin adds build and ci as required checks, auto-merge will hold minor/patch updates until both pass.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5a6bdfb. Configure here.}