Skip to content

docs: bump the docs-deps group across 1 directory with 6 updates - #337

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/docs-deps-67a2c41381
Closed

docs: bump the docs-deps group across 1 directory with 6 updates#337
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/docs-deps-67a2c41381

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the docs-deps group with 6 updates in the /docs directory:

Package From To
@astrojs/starlight 0.38.5 0.40.0
astro 6.3.7 6.4.6
katex 0.16.47 0.17.0
sharp 0.34.5 0.35.0
@cloudflare/workers-types 4.20260521.1 4.20260610.1
wrangler 4.93.1 4.99.0

Updates @astrojs/starlight from 0.38.5 to 0.40.0

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.40.0

Minor Changes

  • #3923 edf2e6b Thanks @​Princesseuh! - Adds support for Astro 6.4 and the new Sätteri Markdown processor.

    It is now possible to opt into using Astro's 6.4 Sätteri Markdown processor by installing the @astrojs/markdown-satteri package and configuring it in your astro.config.mjs file:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
import { satteri } from '@​astrojs/markdown-satteri';
export default defineConfig({
markdown: {
processor: satteri(),
},
});

    ⚠️ BREAKING CHANGE: The minimum supported version of Astro is now v6.4.5.

    Please update Starlight and Astro together:

    npx @astrojs/upgrade

    Community Starlight plugins and Astro integrations may also need to be manually updated to work with Sätteri. If you encounter any issues, please reach out to the plugin or integration author to see if it is a known issue or if an updated version is being worked on.

Patch Changes

@​astrojs/starlight@​0.39.3

Patch Changes

@​astrojs/starlight@​0.39.2

Patch Changes

... (truncated)

Changelog

Sourced from @​astrojs/starlight's changelog.

0.40.0

Minor Changes

  • #3923 edf2e6b Thanks @​Princesseuh! - Adds support for Astro 6.4 and the new Sätteri Markdown processor.

    It is now possible to opt into using Astro's 6.4 Sätteri Markdown processor by installing the @astrojs/markdown-satteri package and configuring it in your astro.config.mjs file:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
import { satteri } from '@​astrojs/markdown-satteri';
export default defineConfig({
markdown: {
processor: satteri(),
},
});

    ⚠️ BREAKING CHANGE: The minimum supported version of Astro is now v6.4.5.

    Please update Starlight and Astro together:

    npx @astrojs/upgrade

    Community Starlight plugins and Astro integrations may also need to be manually updated to work with Sätteri. If you encounter any issues, please reach out to the plugin or integration author to see if it is a known issue or if an updated version is being worked on.

Patch Changes

0.39.3

Patch Changes

0.39.2

Patch Changes

... (truncated)

Commits

Updates astro from 6.3.7 to 6.4.6

Release notes

Sourced from astro's releases.

astro@6.4.6

Patch Changes

  • #16765 b10e86e Thanks @​fkatsuhiro! - Fixes an issue where renaming an image file while the dev server is running triggers a build error. Now Astro correctly hot-reloads the image without crashing.

  • #17026 add3df1 Thanks @​matthewp! - Hardens addAttribute to drop attribute names containing characters that are invalid per the HTML spec (", ', >, /, =, whitespace)

  • #17033 ffda27b Thanks @​matthewp! - Validates the request origin against allowedDomains before fetching prerendered error pages. When allowedDomains is configured and the Host header matches, the original origin is used. Otherwise, the fetch falls back to localhost.

astro@6.4.5

Patch Changes

  • #16985 4ecff32 Thanks @​maximslo! - Fixes the experimental.logger destination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, and adapterLogger re-creates itself when the underlying logger changes so the startup message uses the correct destination.

  • #16947 e0703a6 Thanks @​ematipico! - Fixes Astro.request.url not reflecting validated X-Forwarded-Proto/X-Forwarded-Host headers when security.allowedDomains is configured. Previously, only Astro.url was updated with the forwarded origin while Astro.request.url retained the socket-derived URL, causing the two to diverge behind TLS-terminating proxies.

  • #16997 dc45246 Thanks @​matthewp! - Reverts a change to isNode runtime detection that caused a significant build time regression for Cloudflare adapter users with large prerendered sites

astro@6.4.4

Patch Changes

  • #16926 1b39ae8 Thanks @​narendraio! - Prevents App.match() from throwing on request paths that contain an invalid percent-sequence.

  • #16924 2c0bc94 Thanks @​astrobot-houston! - Fixes an issue where editing a client-side component (e.g. with client:idle, client:load, etc.) caused an unnecessary full program reload of the backend during development.

  • #16958 2c1d50f Thanks @​fkatsuhiro! - Fixes a bug where static file endpoints using getStaticPaths with .html in dynamic param values (e.g. { path: 'file.html' }) would fail with a NoMatchingStaticPathFound error during build. The .html suffix is no longer incorrectly stripped from endpoint route pathnames.

  • #16855 c610cda Thanks @​astrobot-houston! - Fixes dynamic routes returning 500 "TypeError: Missing parameter" when using domain-based i18n routing in SSR.

  • #16946 606c37b Thanks @​ematipico! - Fixes Astro.routePattern to preserve original casing of dynamic parameter names from filenames. Previously, a file at src/pages/blog/[postId].astro would return /blog/[postid] for Astro.routePattern due to an internal .toLowerCase() call. It now correctly returns /blog/[postId].

  • #16720 16d49b6 Thanks @​thomas-callahan-collibra! - Fix an issue where dynamic routes would return the string [object Object] instead of the expected content, in certain runtimes.

  • #16703 17390a6 Thanks @​henrybrewer00-dotcom! - Fixes styles being stripped when the project root is started with a path whose case differs from the actual filesystem case (e.g. running astro dev from d:\dev\app while the folder on disk is D:\dev\app).

  • #16855 c610cda Thanks @​astrobot-houston! - Fixes Astro.currentLocale returning the default locale instead of the domain's locale on dynamic routes served from a mapped domain.

astro@6.4.3

Patch Changes

  • #16900 17a0fbd Thanks @​ocavue! - Bumps devalue dependency to v5.8.1

  • #16016 0d85e1b Thanks @​felmonon! - Fix a false positive in the dev toolbar accessibility audit for anchors with text inside closed <details> elements.

  • #16911 79c6c46 Thanks @​astrobot-houston! - Fixes a bug where experimental.advancedRouting with astro/hono handlers threw TypeError: Cannot read properties of undefined (reading 'route') for unmatched routes instead of rendering the custom 404 page.

  • #16899 239c469 Thanks @​matthewp! - Fixes a false "does not call the middleware() handler" warning when using astro() in a custom src/app.ts and the first request is a redirect route.

  • #16887 493acdb Thanks @​astrobot-houston! - Fixes redirectToDefaultLocale not working after the Advanced Routing refactoring.

... (truncated)

Changelog

Sourced from astro's changelog.

6.4.6

Patch Changes

  • #16765 b10e86e Thanks @​fkatsuhiro! - Fixes an issue where renaming an image file while the dev server is running triggers a build error. Now Astro correctly hot-reloads the image without crashing.

  • #17026 add3df1 Thanks @​matthewp! - Hardens addAttribute to drop attribute names containing characters that are invalid per the HTML spec (", ', >, /, =, whitespace)

  • #17033 ffda27b Thanks @​matthewp! - Validates the request origin against allowedDomains before fetching prerendered error pages. When allowedDomains is configured and the Host header matches, the original origin is used. Otherwise, the fetch falls back to localhost.

6.4.5

Patch Changes

  • #16985 4ecff32 Thanks @​maximslo! - Fixes the experimental.logger destination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, and adapterLogger re-creates itself when the underlying logger changes so the startup message uses the correct destination.

  • #16947 e0703a6 Thanks @​ematipico! - Fixes Astro.request.url not reflecting validated X-Forwarded-Proto/X-Forwarded-Host headers when security.allowedDomains is configured. Previously, only Astro.url was updated with the forwarded origin while Astro.request.url retained the socket-derived URL, causing the two to diverge behind TLS-terminating proxies.

  • #16997 dc45246 Thanks @​matthewp! - Reverts a change to isNode runtime detection that caused a significant build time regression for Cloudflare adapter users with large prerendered sites

6.4.4

Patch Changes

  • #16926 1b39ae8 Thanks @​narendraio! - Prevents App.match() from throwing on request paths that contain an invalid percent-sequence.

  • #16924 2c0bc94 Thanks @​astrobot-houston! - Fixes an issue where editing a client-side component (e.g. with client:idle, client:load, etc.) caused an unnecessary full program reload of the backend during development.

  • #16958 2c1d50f Thanks @​fkatsuhiro! - Fixes a bug where static file endpoints using getStaticPaths with .html in dynamic param values (e.g. { path: 'file.html' }) would fail with a NoMatchingStaticPathFound error during build. The .html suffix is no longer incorrectly stripped from endpoint route pathnames.

  • #16855 c610cda Thanks @​astrobot-houston! - Fixes dynamic routes returning 500 "TypeError: Missing parameter" when using domain-based i18n routing in SSR.

  • #16946 606c37b Thanks @​ematipico! - Fixes Astro.routePattern to preserve original casing of dynamic parameter names from filenames. Previously, a file at src/pages/blog/[postId].astro would return /blog/[postid] for Astro.routePattern due to an internal .toLowerCase() call. It now correctly returns /blog/[postId].

  • #16720 16d49b6 Thanks @​thomas-callahan-collibra! - Fix an issue where dynamic routes would return the string [object Object] instead of the expected content, in certain runtimes.

  • #16703 17390a6 Thanks @​henrybrewer00-dotcom! - Fixes styles being stripped when the project root is started with a path whose case differs from the actual filesystem case (e.g. running astro dev from d:\dev\app while the folder on disk is D:\dev\app).

  • #16855 c610cda Thanks @​astrobot-houston! - Fixes Astro.currentLocale returning the default locale instead of the domain's locale on dynamic routes served from a mapped domain.

6.4.3

Patch Changes

  • #16900 17a0fbd Thanks @​ocavue! - Bumps devalue dependency to v5.8.1

  • #16016 0d85e1b Thanks @​felmonon! - Fix a false positive in the dev toolbar accessibility audit for anchors with text inside closed <details> elements.

  • #16911 79c6c46 Thanks @​astrobot-houston! - Fixes a bug where experimental.advancedRouting with astro/hono handlers threw TypeError: Cannot read properties of undefined (reading 'route') for unmatched routes instead of rendering the custom 404 page.

... (truncated)

Commits

Updates katex from 0.16.47 to 0.17.0

Release notes

Sourced from katex's releases.

v0.17.0

0.17.0 (2026-05-22)

Performance Improvements

  • simplify defineFunction to avoid destructuring, improve typing (#4222) (fb604e6)

BREAKING CHANGES

  • The internal API for __defineFunction changed: you should no longer wrap properties in props.
Changelog

Sourced from katex's changelog.

0.17.0 (2026-05-22)

Performance Improvements

  • simplify defineFunction to avoid destructuring, improve typing (#4222) (fb604e6)

BREAKING CHANGES

  • The internal API for __defineFunction changed: you should no longer wrap properties in props.
Commits
  • 3dec549 chore(release): 0.17.0 [ci skip]
  • fb604e6 perf: simplify defineFunction to avoid destructuring, improve typing (#4222)
  • 6caa636 refactor: tighten ParseNode types (#4219)
  • afed784 docs: make first supportive organizations logos bigger (#4216)
  • b02d9ac chore(deps): update dependency webpack-dev-server to v5.2.4 [security] (#4220)
  • See full diff in compare view

Updates sharp from 0.34.5 to 0.35.0

Release notes

Sourced from sharp's releases.

v0.35.0

  • Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

  • Breaking: Remove install script from package.json file. Compiling from source is now opt-in via the build script.

  • Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

  • Breaking: Add limitInputChannels with a default value of 5.

  • Breaking: Remove deprecated failOnError constructor property.

  • Breaking: Remove deprecated paletteBitDepth from metadata response.

  • Breaking: Remove deprecated properties from sharpen operation.

  • Breaking: Rename format.jp2k as format.jp2 for API consistency.

  • Upgrade to libvips v8.18.3 for upstream bug fixes.

  • Remove experimental status from WebAssembly binaries.

  • Add prebuilt binaries for FreeBSD (WebAssembly).

  • Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

  • Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

  • Add AVIF/HEIF tune option for control over quality metrics. #4227

  • Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps. #4314

  • Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer. #4355

  • Require prebuilt binaries using static paths to aid code bundling. #4380

  • TypeScript: Ensure FormatEnum keys match reality. #4475

  • Add margin option to trim operation. #4480 @​eddienubes

  • Ensure HEIF primary item is used as default page/frame. #4487

... (truncated)

Commits
  • 2ed5af4 Release v0.35.0
  • 4475cf1 Tests: update locator hash for sharp-libvips v1.3.0
  • deb22dd Upgrade to sharp-libvips v1.3.0
  • 07f1be9 Prerelease v0.35.0-rc.8
  • df1109b Prerelease v0.35.0-rc.7
  • aca49b3 Upgrade to libvips v8.18.3
  • e9e86f5 Type-check density option before range validation (#4536)
  • 2f0bcf0 Docs: update supported image formats
  • 98e03b8 Revert "Guard heif bitdepth property for prebuilt binaries"
  • e4ea2f3 CI: Ignore package minimum age in smoke tests
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 4.20260521.1 to 4.20260610.1

Commits

Updates wrangler from 4.93.1 to 4.99.0

Release notes

Sourced from wrangler's releases.

wrangler@4.99.0

Minor Changes

  • #14169 0706fbf Thanks @​edmundhung! - Introduce createTestHarness() for integration testing Workers

    It runs Workers in a local preview environment using production build output and works with both Wrangler projects and Workers built by the Cloudflare Vite plugin.

    Use it from any Node.js test runner to send requests to individual Workers, trigger scheduled events, reset the server between tests, and mock outbound requests with libraries that intercept globalThis.fetch(), such as MSW.

    You can also capture structured logs from your Workers with getLogs(), or dump out a diagnostic timeline with debug() when tests fail:

    import { createTestHarness } from "wrangler";
const server = createTestHarness({
workers: [
{ configPath: "./dist/web_worker/wrangler.json" },
{ configPath: "./dist/api_worker/wrangler.json" },
],
});
await server.listen();
await server.fetch("http://example.com");
const apiWorker = server.getWorker("api-worker");
await apiWorker.fetch("http://example.com/users/123");
await apiWorker.scheduled({ cron: "0 0 * * *" });
server.getLogs();
if (testFailed) {
server.debug();
}
await server.reset();
await server.close();

  • #14174 8cf8c61 Thanks @​oliy! - Surface pipeline status and failure reasons in wrangler pipelines list and wrangler pipelines get

    wrangler pipelines list now includes a Status column, and when any pipelines are in a failed state it prints a summary of each failing pipeline along with the reason reported by the API.

    wrangler pipelines get now shows the pipeline Status in the general details and, for failed pipelines, highlights the failure with the reason returned by the server so it is clear why a pipeline is not running.

  • #14211 a61ac29 Thanks @​james-elicx! - Add --version-tag support to wrangler versions deploy to deploy a version by its tag

    You can now roll out or roll back a version by the tag it was uploaded with (e.g. a commit SHA passed to --tag at upload time) instead of first looking up its Version ID:

    wrangler versions deploy --version-tag <sha>@100%

... (truncated)

Commits
  • 8a4bfe5 Version Packages (#14179)
  • f8d7700 feat(wrangler): capture runtime logs and print debug timelines with `createTe...
  • 4bb572f Bump the workerd-and-workers-types group with 2 updates (#14231)
  • dcd116a feat(wrangler): improve createTestHarness() configuration setup (#14227)
  • 75e652a Revert "Make Ctrl+C triggered during the skills-install prompt dismiss it per...
  • e13b8c0 [C3] Bump @​angular/create from 21.2.13 to 22.0.0 in /packages/create-cloudfla...
  • a61ac29 [wrangler] Add --version-tag support to versions deploy (#14211)
  • 24497d0 Bump the workerd-and-workers-types group with 2 updates (#14217)
  • 0706fbf feat(wrangler): createTestHarness API (#14169)
  • 8923f97 Preserve all deployment-affecting CLI flags in the interactive deploy config ...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
docs: bump the docs-deps group across 1 directory with 6 updates
9710911 
Bumps the docs-deps group with 6 updates in the /docs directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.38.5` | `0.40.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.3.7` | `6.4.6` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.16.47` | `0.17.0` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20260521.1` | `4.20260610.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.93.1` | `4.99.0` |



Updates `@astrojs/starlight` from 0.38.5 to 0.40.0
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.40.0/packages/starlight)

Updates `astro` from 6.3.7 to 6.4.6
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@6.4.6/packages/astro)

Updates `katex` from 0.16.47 to 0.17.0
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.16.47...v0.17.0)

Updates `sharp` from 0.34.5 to 0.35.0
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.0)

Updates `@cloudflare/workers-types` from 4.20260521.1 to 4.20260610.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `wrangler` from 4.93.1 to 4.99.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.99.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docs-deps
- dependency-name: astro
  dependency-version: 6.4.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docs-deps
- dependency-name: katex
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docs-deps
- dependency-name: sharp
  dependency-version: 0.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docs-deps
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 4.20260610.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: docs-deps
- dependency-name: wrangler
  dependency-version: 4.99.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: docs-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 10, 2026
@dependabot
dependabot Bot requested review from a team and EricAndrechek June 10, 2026 23:36
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 10, 2026
@github-actions github-actions Bot added documentation Improvements or additions to documentation area/docs Documentation, site/, README labels Jun 10, 2026
@EricAndrechek EricAndrechek moved this from Backlog to In review in WaveHouse Task Board Jun 10, 2026
@EricAndrechek EricAndrechek mentioned this pull request Jun 11, 2026
Merged
EricAndrechek added a commit that referenced this pull request Jun 11, 2026
@EricAndrechek @claude
ci: consolidate Dependabot npm updates to the pnpm workspace root (#340)
09250c6 
## Problem

Every Dependabot **npm** PR has been failing CI since the #190
root-lockfile consolidation — e.g. #211 (`@vitest/coverage-v8` in
`tests/e2e/sdk`) and #337 (the `docs` group). They fail fast on
Lint/Unit/E2E/Coverage and **a rebase never fixes them**.

Root cause is the Dependabot config, not the dependencies. The repo is a
pnpm workspace with a **single root `pnpm-lock.yaml`**, but
`.github/dependabot.yml` pointed its three npm entries at the *member*
directories (`directory: /docs`, `/clients/ts`, `/tests/e2e/sdk`).
Dependabot only updates a lockfile co-located with the manifest it
targets, so it edited the member `package.json` but **left the root
lockfile untouched**. CI then runs `pnpm install --frozen-lockfile`, the
lockfile's recorded specifier no longer matches `package.json`, and it
aborts with `ERR_PNPM_OUTDATED_LOCKFILE`. A rebase only replays the same
`package.json`-only change onto fresh `main` — it never regenerates the
lockfile, so the mismatch returns every run. (#337, created well after
#190, fails identically — confirming it's structural, not a stale
branch.)

## Fix

Replace the three per-member npm entries with **one entry at the
workspace root** (`directory: /`, group `npm-deps`, prefix `deps`). At
the root, Dependabot reads `pnpm-workspace.yaml`, walks every member,
and updates the single root lockfile inside the PR. As a bonus it now
also covers the root `package.json`'s own devDeps (biome, markdownlint,
nyc), which the per-member configs never did.

**Trade-off:** one combined weekly npm PR with a single `deps:` prefix,
instead of three per-area PRs (`docs:` / `deps(sdk):` / `deps(tests):`).
This matches the existing grouped `go-deps` / `actions-deps` configs and
the team's stated preference for fewer Monday PRs.

## Docs sync

- `docs/src/content/docs/development.md` — Dependabot section: five
configs → three, plus the root-lockfile rationale.
- `SECURITY.md` — supply-chain line: "three npm workspaces" → one root
npm config.
- `CHANGELOG.md` — `[Unreleased] → Changed` entry.

## Note (out of scope)

`pnpm-workspace.yaml` sets `minimumReleaseAge: 10080` (7-day cooldown),
which Dependabot doesn't honor. When the new config regenerates
lockfiles, a dep released <7 days ago can be held by the cooldown at
install time — so a freshly-cut bump may need a few days before it
merges cleanly. Pre-existing; the no-auto-merge + admin-review gate
covers it.

## Follow-up on the broken PRs

Once this merges, the old per-member configs no longer exist, so #211
and #337 should be **closed** (not rebased — rebasing keeps the old
member-directory branch and reproduces the failure). The new root config
regenerates correct combined PRs on the next Dependabot run.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@EricAndrechek

EricAndrechek commented Jun 11, 2026

Copy link
Copy Markdown
Member

closed by #340

@dependabot @github

dependabot Bot commented on behalf of github Jun 11, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@github-project-automation github-project-automation Bot moved this from In review to Done in WaveHouse Task Board Jun 11, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/docs/docs-deps-67a2c41381 branch June 11, 2026 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@EricAndrechek EricAndrechek Awaiting requested review from EricAndrechek EricAndrechek was automatically assigned from Wave-RF/wavehouse-admins

Assignees

No one assigned

Labels

area/docs Documentation, site/, README dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation javascript Pull requests that update javascript code

Projects

WaveHouse Task Board
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@EricAndrechek