Stop bumping dev deps and group production PRs

[consideRatio]

• Closes Is it possible to redefine package.json in a way to reduce dependacy bumps? #316 by reducing the PR bump noise to at most one package.json bump PR a month, by no longer bumping dev dependencies, and grouping bumps of other dependencies.

Let's get this merged before November 1!

[manics]

Sounds like a good idea! Is there a reason we need to exclude dev dependencies- couldn't we just update everything in one go?

[consideRatio]

I see some value in separating prod from dev dependencies, but if we are to bump both - maybe I'd prefer one less PR by combing them.

My preferences ordered, but happy to go based on yours:

1. prod only bumped
2. prod and dev bumped
3. prod and dev bumped, grouped by prod and dev separetely, so two PRs are opened monthly for this

Do you prefer to go with option 2, bumping dev deps also in the same PR @manics?

[manics]

Yes, I was thinking of bumping prod+dev (and anything else!) in one PR. Unless there's a good reason not to bump dev dependencies?

[consideRatio]

Unless there's a good reason not to bump dev dependencies?

Not really, but I figured there wasn't a strong case for bumping them either. With that I vaguely reasoned that we could opt to not be bothered doing it monthly to avoid clutter the PRs we are to review with non-important changes to review.

---

I pushed a commit that I think gets it done!

[manics]

Thanks!

[consideRatio]

Thank you @manics!!!