Bump commander from 14.0.3 to 15.0.0 in the phase-3-runtime group

.github/dependabot.yml

@@ -9,6 +9,10 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
+    ignore:
+      - dependency-name: "commander"
+        update-types:
+          - "version-update:semver-major"
     groups:
       phase-1-safe-updates:
         applies-to: "version-updates"

CHANGELOG.md

@@ -16,6 +16,8 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
+- Kept `commander` on the Node 20-compatible major and ignored future Dependabot major bumps until the CLI runtime
+  floor changes.
 - Fixed `summary morning --text` so it prints a human preview/status even when the JSON result is not sendable.
 
 ## [0.6.0] - 2026-06-05

test/cli.test.ts

@@ -8,6 +8,9 @@ const packageJson = JSON.parse(
   readFileSync(new URL('../package.json', import.meta.url), 'utf8')
 ) as {
   version: string;
+  dependencies: {
+    commander: string;
+  };
   engines: {
     node: string;
   };
@@ -117,4 +120,8 @@ describe('cli', () => {
   test('declares a Node 20 engine floor', () => {
     expect(packageJson.engines.node).toBe('>=20.0.0');
   });
+
+  test('keeps Commander on the Node 20-compatible major', () => {
+    expect(packageJson.dependencies.commander).toMatch(/^\^14\./);
+  });
 });