ci(deps): list dependency updates under Maintenance in the changelog

.github/dependabot.yml

@@ -6,6 +6,11 @@ updates:
       interval: daily
     labels:
       - Dependencies
+    # Release Please lists the "deps" type under "Maintenance" in the changelog.
+    # Without an explicit prefix Dependabot copies the style of recent commits
+    # and ends up with "feat(deps)", which shows up under "Added".
+    commit-message:
+      prefix: deps
     # Wait after release before opening update PRs — gives the ecosystem time
     # to catch malicious releases (supply-chain protection).
     cooldown:
@@ -37,6 +42,8 @@ updates:
       interval: weekly
     labels:
       - Dependencies
+    commit-message:
+      prefix: deps
     # Actions are pulled by SHA, but a compromised release is still a risk —
     # wait a week so takedowns/reverts can happen first. semver-major-days is
     # not supported for the github-actions ecosystem, so only the default

.github/workflows/pr-title.yml

@@ -33,9 +33,9 @@ jobs:
         env:
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
-          pattern='^(feat|fix|refactor|perf|docs|style|chore|test|build|ci|revert)(\([^()]+\))?!?: [^[:space:]].*$'
+          pattern='^(feat|fix|refactor|perf|docs|style|deps|chore|test|build|ci|revert)(\([^()]+\))?!?: [^[:space:]].*$'
           if [[ ! "$PR_TITLE" =~ $pattern ]]; then
             echo "::error title=Invalid PR title::The title must follow Conventional Commits, e.g. 'feat(hyva): add readiness check'. Do not start it with an emoji."
-            echo "Allowed types: feat, fix, refactor, perf, docs, style, chore, test, build, ci, revert"
+            echo "Allowed types: feat, fix, refactor, perf, docs, style, deps, chore, test, build, ci, revert"
             exit 1
           fi

CONTRIBUTING.md

@@ -45,6 +45,7 @@ Examples:
 - `style:` - Code style changes (no version bump)
 - `test:` - Test updates (no version bump)
 - `chore:` - Maintenance tasks (no version bump)
+- `deps:` - Dependency updates (patch version bump, listed under "Maintenance"; used by Dependabot)
 
 **Breaking Changes**: Add `!` after the type for major version bumps:
 
@@ -83,7 +84,7 @@ All pull requests are merged using **squash-merge** to maintain a clean, linear
 - ✅ PR title becomes the commit message
 - ✅ All PR commits are squashed into a single commit
 - ✅ Easier to follow project history and revert changes if needed
-- ⚠️ Do not use "Create a merge commit" or "Rebase and merge": Release Please then only sees the individual commits and ignores everything that is not a Conventional Commit
+- ⚠️ The changelog is built from the PR title, so it must be a valid Conventional Commit whichever merge button is used. A merge commit also works because Release Please reads the PR title; avoid "Rebase and merge", where only the individual commits are visible and these would have to be Conventional Commits too
 
 ---
 

docs/development.md

@@ -321,6 +321,7 @@ Release Please groups changes into sections based on the Conventional Commits ty
 | `perf:`     | **Performance**   | ✅ Yes           |
 | `docs:`     | **Documentation** | ✅ Yes           |
 | `style:`    | **Styling**       | ✅ Yes           |
+| `deps:`     | **Maintenance**   | ✅ Yes           |
 | `chore:`    | Chore             | ❌ Hidden        |
 | `test:`     | Tests             | ❌ Hidden        |
 | `build:`    | Build             | ❌ Hidden        |

release-please-config.json

@@ -45,6 +45,11 @@
           "section": "Styling",
           "hidden": false
         },
+        {
+          "type": "deps",
+          "section": "Maintenance",
+          "hidden": false
+        },
         {
           "type": "chore",
           "section": "Chore",