Dependency Updates

Dependency Updates — Runbook

How dependency updates flow through this repo. Dependabot runs monthly for both npm (pnpm) and github-actions, plus opens security PRs immediately.

Two freshness gates

1. Dependabot cooldown (.github/dependabot.yml, cooldown.default-days: 7) — delays opening a routine PR until the version is 7 days old.
2. pnpm quarantine (pnpm-workspace.yaml, minimumReleaseAge: 10080, strict) — pnpm install refuses to resolve any version younger than 7 days.

Aligned at 7 days so a routine PR is always installable. The quarantine is a malware net: in the May 2026 supply-chain attacks, malicious versions were flagged within minutes — a 7-day hold means your machine never touches them.

The three lanes

Class	How it arrives	Merge discipline
Security advisory	Immediate, individual PR (ignores cooldown/grouping)	Review the specific version, then merge ASAP. Highest priority.
Routine patch/minor	One grouped PR per ecosystem, monthly	Manual merge after CI green.
Major	Individual PR	Deliberate manual review. Never rushed.

Auto-merge is OFF for everything. Every PR gets a human merge. Grouping + cooldown cut the toil without delegating the merge decision to CI.

Verifying a Dependabot PR before merge

pnpm install
pnpm exec tsc -b --noEmit                    # NOT bare `tsc --noEmit` (root tsconfig has files: [])
pnpm exec biome check --error-on-warnings    # catches newly-stable lint rules
pnpm test
pnpm build                                   # if it touches vite / postcss / the build

Urgent security patch younger than 7 days

The quarantine will block pnpm install. Do NOT lower the global setting. Vet that specific version (right maintainer? changelog matches the CVE?), then add a version-pinned exclude to pnpm-workspace.yaml:

minimumReleaseAgeExclude:
  - <package>@<exact-version>   # reviewed <date> for <reason>

Pin the exact version so the next release still faces the quarantine. This is the fflate@0.8.3 precedent already in the file.

Majors that need a dedicated effort

If a major fails verification (e.g. a TypeScript major with type errors), leave its Dependabot PR open as the tracking anchor and schedule a focused upgrade session. Don’t force it into a routine batch.

Related

• Install-time quarantine config: pnpm-workspace.yaml (minimumReleaseAge, minimumReleaseAgeExclude)
• Exact-pin enforcement (pre-commit gate): scripts/check-package-policy.mjs