From f6a5eacda8afa48501485f34db380acb40a52dbe Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:57:25 -0500
Subject: [PATCH] hold react-zoom-pan-pinch above 3.4.4 and monaco-editor from
 0.54

---
 .github/dependabot.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d8b7ab2e6b..165bcb8d8f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -122,12 +122,14 @@ updates:
       # Intermittent failure in the UI settings import spec, cause not found
       - dependency-name: "zod"
         update-types: ["version-update:semver-major"]
-      # Needs an on-device pinch test before moving
+      # Every later version clamps the pan when the player hides or drops
+      # pinch gestures near the edges, 4.2.0 included
       - dependency-name: "react-zoom-pan-pinch"
-        update-types: ["version-update:semver-major"]
-      # Build fails until monaco-worker-manager releases its PR 4
+        versions: [">3.4.4"]
+      # 0.54 pins a vulnerable dompurify; 0.55+ breaks YAML validation until
+      # monaco-worker-manager releases its PR 4
       - dependency-name: "monaco-editor"
-        versions: [">=0.55.0"]
+        versions: [">=0.54.0"]
       # Later versions need Node 22 and extract false keys
       - dependency-name: "i18next-cli"
         versions: [">1.5.11"]