Fix failing Dependabot PRs: CodeQL version lockstep, Babel 8 block, undici bundle

.github/dependabot.yml

@@ -6,8 +6,30 @@ updates:
       interval: daily
     cooldown:
       default-days: 7
+    groups:
+      # init/autobuild/analyze must always be on the same version, otherwise
+      # autobuild fails with "Loaded a configuration file for version X, but
+      # running version Y". Keep them in a single PR.
+      codeql-action:
+        patterns:
+          - 'github/codeql-action*'
 
   - package-ecosystem: npm
     directory: /
     schedule:
-      interval: weekly
+      interval: weekly
+    groups:
+      # @babel/core and @babel/preset-env are peer-linked; bumping either one
+      # on its own produces an npm ERESOLVE conflict.
+      babel:
+        patterns:
+          - '@babel/*'
+          - 'babel-*'
+    ignore:
+      # ts-jest (29.4.12, latest) declares
+      # peerOptional @babel/core ">=7.0.0-beta.0 <8", so Babel 8 cannot be
+      # installed here yet. Remove these once ts-jest supports Babel 8.
+      - dependency-name: '@babel/core'
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@babel/preset-env'
+        update-types: ['version-update:semver-major']

.github/workflows/codeql-analysis.yml

@@ -42,7 +42,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
       with:
         languages: ${{ matrix.language }}
         source-root: src
@@ -54,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0