fix(scaffold): ignore vitest major bumps in new mcp-servers (#99)

* fix(scaffold): ignore vitest major bumps in new mcp-servers

A vitest 4 lockfile rewrite already broke npm ci on an existing server; new repos should ship the same ignore.

Signed-off-by: fOuttaMyPaint <154358121+TMHSDigital@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: sync docs footer to VERSION 1.19.1

Signed-off-by: fOuttaMyPaint <154358121+TMHSDigital@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Signed-off-by: fOuttaMyPaint <154358121+TMHSDigital@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: TMHSDigital

VERSION

@@ -1 +1 @@
-1.19.0
+1.19.1

docs/index.html

@@ -345,7 +345,7 @@ <h3>Scaffold Generator</h3>
       </div>
       <div class="footer-divider"></div>
       <div class="footer-meta">
-        <span id="footerVersion">v1.19.0</span>
+        <span id="footerVersion">v1.19.1</span>
         <span>&middot;</span>
         <span>CC-BY-NC-ND-4.0</span>
         <span>&middot;</span>

scaffold/templates/dependabot.yml.j2

@@ -22,6 +22,10 @@ updates:
       # of the supported runtimes.
       - dependency-name: "@types/node"
         versions: [">=23"]
+      # Hold vitest 3.x. A 4.x bump rewrote the lockfile without optional
+      # esbuild platform packages, so npm ci failed. Major upgrades stay manual.
+      - dependency-name: "vitest"
+        update-types: ["version-update:semver-major"]
 {% endif %}
 {% if has_mcp %}
   - package-ecosystem: "pip"

tests/test_scaffold_born_green.py

@@ -338,6 +338,9 @@ def test_deployed_service_shape(rendered):
     assert "gh workflow run publish.yml" in (
         library / ".github" / "workflows" / "release.yml"
     ).read_text(encoding="utf-8")
+    dep = (library / ".github" / "dependabot.yml").read_text(encoding="utf-8")
+    assert 'dependency-name: "vitest"' in dep
+    assert "version-update:semver-major" in dep
 
 
 def _make_temp_registry_root(tmp_path: Path) -> Path: