Dependabot: target dev, defer ModelContextProtocol majors to #1990

.github/dependabot.yml

@@ -6,6 +6,9 @@ updates:
   # .NET packages across the solution (PerformanceMonitor.sln discovers all projects).
   - package-ecosystem: "nuget"
     directory: "/"
+    # All work lands on dev; the check-branches guard rejects any PR to main that is not
+    # dev itself, so Dependabot PRs against main (the previous default) could never merge.
+    target-branch: "dev"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -15,10 +18,19 @@ updates:
       nuget:
         patterns:
           - "*"
+    ignore:
+      # The MCP SDK 2.x major changes runtime behavior on both MCP hosts (stateless-by-default
+      # HTTP, discovery-first negotiation, deprecated Roots/Sampling/Logging APIs) and must move
+      # in every referencing project + lockfile at once — a grouped auto-bump half-applied it and
+      # poisoned the whole group (#1822). Majors are taken deliberately via #1990; minors/patches
+      # keep flowing. Remove this once #1990 lands.
+      - dependency-name: "ModelContextProtocol*"
+        update-types: ["version-update:semver-major"]
 
   # GitHub Actions used by the workflows in .github/workflows.
   - package-ecosystem: "github-actions"
     directory: "/"
+    target-branch: "dev"
     schedule:
       interval: "weekly"
       day: "monday"

CHANGELOG.md

@@ -406,6 +406,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **The live compression tests had two ~200-second windows around midnight where they failed for the clock rather than for the code** ([#1972], caught on a dev-to-PR pair the same night) - three `*_AgainstDevPostgres` tests seeded their chunks with `now()`-relative timestamps spanning 200 seconds into day-aligned chunks, so what time of day the suite ran decided how many chunks a seed produced. Run between 00:00:00 and 00:03:20 UTC the young seed straddled midnight and landed TWO chunks instead of one, and the uncompressed count asserted 1 against an actual 2; run between 23:56:40 and 23:59:59 an old seed crossed the boundary N days back into two closed, both-eligible chunks, and the compressed count failed the same way in the other direction. This is not the reused-database flake that moves between unrelated classes - it is deterministic inside the window and green outside it, which is what the evidence showed: a `dev` run started 23:50 UTC went green, a PR run carrying a byte-identical `TimescaleSupportTests.cs` failed at 00:01:38 UTC on exactly the line above, and a rerun outside the window passed with no code change. All four seeds now anchor to midday (`date_trunc('day', now()::timestamp)` plus twelve hours), which puts 12 hours of margin either side of a 200-second span, so chunk placement no longer depends on when the suite runs. Confirmed against a live TimescaleDB rig by entering both windows on demand with literal anchors rather than waiting for them: the current forms reproduce the expected-1-actual-2 shape in both directions, the midday form gives 1 and 1, and a sweep across all 1440 minutes of the day splits on 3 minutes for each `now()`-relative form and none for either midday one. The young chunk keeps the property its test pins - midday today sits in today's chunk, whose `range_end` is tomorrow's midnight, so the "still young" assert holds at every hour. Test-suite only - no shipped code changed.
 
+- **Dependabot's PRs now target `dev`, where they can actually merge** ([#1822]) - the config never set `target-branch`, so Dependabot opened its weekly grouped PRs against the repository default branch, `main` - and the check-branches guard rejects any PR to main that is not dev itself, so every one of them was born unmergeable. The first one demonstrated a second problem on its way down: the NuGet group half-applied the ModelContextProtocol 1.4.1-to-2.0.0 major (three projects bumped, Lite and deprecated/Dashboard left at 1.4.1), which locked-mode restore rejected outright (NU1605 downgrade conflicts, NU1004 lockfile inconsistencies) - and even a mechanically clean bump of that major changes runtime behavior on both MCP hosts (stateless-by-default HTTP, discovery-first negotiation, deprecated Roots/Sampling/Logging APIs). Both update blocks now carry `target-branch: "dev"`, and `ModelContextProtocol*` semver-majors are ignored - same shape as the existing upload-artifact ignore - until the deliberate migration ([#1990]) lands, at which point the ignore rule comes out and minors/patches keep flowing through the weekly group throughout. One honest limit: Dependabot reads this file from the DEFAULT branch, so the retarget takes effect at the next dev-to-main release promotion, not on merge. Config only - no shipped code changed.
+
 ## [3.3.0] - 2026-07-29
 
 ### Important
@@ -2451,3 +2453,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1949]: https://github.com/erikdarlingdata/PerformanceMonitor/issues/1949
 [#1952]: https://github.com/erikdarlingdata/PerformanceMonitor/issues/1952
 [#1951]: https://github.com/erikdarlingdata/PerformanceMonitor/issues/1951
+[#1822]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/1822
+[#1990]: https://github.com/erikdarlingdata/PerformanceMonitor/issues/1990