This helps to prevent PR spam, and avoids breaking changes in Typescript.
- All major version updates get their own PRs
- All security updates get their own PRs
- TypeScript should always have its own PR, even for patch and minor versions (it doesn't follow SemVer)
- Everything else (i.e. patch and minor version updates) should be grouped into a single PR to reduce PR spam