[mforce]

Dependency bumps that ship to users now appear in the release notes, under a new "Dependencies" section. The Dependabot prefixes in .github/dependabot.yml all start with chore(...), which this release config hides. The last 40 merged Dependabot PRs all carry a chore(...) title.

Changes

• release-please-config.json adds a visible deps section, "Dependencies".

• .github/dependabot.yml gives the updates that ship a deps prefix:

  • web runtime packages get deps(web), and web dev dependencies keep chore(web) through prefix-development;
  • NuGet packages get deps;
  • Docker base images get deps(docker).

  GitHub Actions and the web linter stay chore(...). The file's header comment explains the split.

• CONTRIBUTING.md adds deps to the commit-type table. docs/releasing.md adds it to the types that open a release PR.

Effects

• A merged runtime, NuGet or Docker bump now opens or updates the release PR. Under the old config, dependency-only merges opened none (docs/releasing.md).
• Security updates use the prefix of their directory's entry: #1357 and #1358 for /web came with chore(web). tools/verify/mcp has no entry, so its security PRs keep Dependabot's default chore(deps) and stay hidden (#1354, #1359). It is a dev-only verification client, so hidden is right.
• NuGet has no separate dev-dependency prefix, so test and analyzer package bumps show under Dependencies too.
• Bumps already merged for 1.2.0 keep their chore titles and stay hidden.

Verification

• The JSON and YAML parse. The 55 tests under .github/scripts pass.
• Dependabot's PrNamePrefixer picks the dev prefix when every updated dependency in a PR is a dev dependency, grouped PRs included. So the dev-tooling group keeps chore(web).
• In the pinned release-please 17.6.0, both deps: … and deps(web): … parse as type deps and land in the new section.
• No workflow, script or test reads the old title prefixes. The NuGet lockfix workflow matches on the branch name.
• Neither a live Dependabot run nor a live release-please run was done. The first PRs after merge will show the new titles.