- dependabot ignore for npm does NOT support wildcards (only groups.patterns does). The '@tsparticles/*' rule was silently ignored -> v4 bumps kept landing. Replace with exact scoped names. - bump actions/checkout v5->v7 (closes dependabot PR #5); the CI failure on that PR was a stale-branch format-check, not checkout v7. Open @tsparticles PRs now closed (#9 already closed earlier).