chore(deps): bump @inquirer/core to 12.0.0 and @changesets/cli to 3.0.3

[clay-good]

Replaces Dependabot #1930 and #1931 with one PR.

Status

Not yet — the flake.nix pnpmDeps hash still needs its real value (see Notes). Everything else is done and verified.

Why this is needed

Both Dependabot PRs rewrite the same flake.nix pnpmDeps hash, so whichever lands first makes the other stale. Dependabot also discards commits pushed to its own branches on rebase, so the hash cannot be fixed in place. Consolidating means the hash is computed once against the final lockfile.

What it does

Bump	From	To	Surface
@inquirer/core (#1931)	^11.2.1	^12.0.0	package.json + lockfile
@changesets/cli (#1930)	3.0.2	3.0.3	lockfile only (range stays ^3.0.1, matching #1930)

Proof it works

• Full suite: 5818 passed, 2 failed. Those 2 (artifact-workflow "creates skills for Cursor tool" and config-profile "confirmed project apply…") fail identically on clean main — verified by running them on origin/main with a fresh install. Pre-existing, unrelated.
• The @inquirer/core major was previously rejected in chore(deps): bump @inquirer/core from 10.3.2 to 11.2.1 #1422 because @inquirer/prompts@7 bundled core 10 and the Windows init prompt test hung. That no longer applies: the repo is on @inquirer/prompts@8, and chore(deps): bump @inquirer/core from 11.2.1 to 12.0.0 #1931's CI passed on linux, macOS and Windows.
• Security overrides preserved: brace-expansion, postcss, js-yaml (x2), nanoid, fflate are all still in the lockfile's overrides block, and test/pnpm-workspace-config.test.ts passes.

Notes

• The pnpmDeps hash in flake.nix is still the old value. No nix or running docker daemon locally, so Nix Flake Validation will fail once and report the real got: hash, which then lands as a one-line fix.
• Use pnpm@10.34.5 (the pinned packageManager) for any lockfile work here. pnpm@9 silently drops the overrides block, because the overrides live in pnpm-workspace.yaml, which only pnpm 10+ reads.
• On merge, Dependabot closes chore(deps-dev): bump @changesets/cli from 3.0.2 to 3.0.3 in the development-dependencies group #1930 and chore(deps): bump @inquirer/core from 11.2.1 to 12.0.0 #1931 on its own.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the @inquirer/core dependency to version 12.0.0.
  • Refreshed package dependency metadata to keep the project’s packaged dependencies consistent.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: Fission-AI/OpenSpec/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 745e0365-073e-4f45-a0fb-3ecaf0a74fc5

📥 Commits

Reviewing files that changed from the base of the PR and between 6abda18 and 6cb7aec.

📒 Files selected for processing (1)

• flake.nix

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The package manifest updates @inquirer/core from ^11.2.1 to ^12.0.0. The Nix derivation updates its pnpmDeps hash.

Changes

Dependency update

Layer / File(s)	Summary
Update @inquirer/core constraint package.json	The dependency constraint changes from ^11.2.1 to ^12.0.0.
Update Nix dependency hash flake.nix	The pnpmDeps hash changes to match the updated dependency content.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 6cb7a

No merge-blocking issue was confirmed; run the normal Nix validation before release.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The whole-PR diff directly changes @inquirer/core from ^11.2.1 to ^12.0.0 in package.json and updates its lockfile graph. Issue #1930 covers the Changesets dependency update only. No directly …	Remove the @inquirer/core upgrade and its resulting lockfile changes, or provide a directly linked issue that requires this upgrade.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the two dependency updates: @inquirer/core and @changesets/cli. It is concise and accurately reflects the pull request objectives.
Linked Issues check	✅ Passed	Issue #1930 requires @changesets/cli 3.0.3. The whole-PR diff updates the lockfile from @changesets/cli@3.0.2 to @changesets/cli@3.0.3 and keeps the ^3.0.1 importer range. It also updates `@ch…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Out of Scope Changes check

Explanation

The whole-PR diff directly changes @inquirer/core from ^11.2.1 to ^12.0.0 in package.json and updates its lockfile graph. Issue #1930 covers the Changesets dependency update only. No directly linked issue establishes scope for the @inquirer/core upgrade. The flake.nix hash refresh is connected to the lockfile changes and is in scope, but it does not establish scope for this separate direct dependency upgrade.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openspec-cloud]

No PR-relevant drift confirmed.

AI-generated · A citation proves the line exists, not that it makes the case — verify before acting.
Checked the 0 requirements selected for this PR at 6abda18 (255 total).
This is not a full-repository clean result; see the check for coverage and any broader findings.
View results · Click Refresh, then Scan again in the check. Or comment /openspec-cloud.

[alfred-openspec]

Reviewed the dependency and lockfile changes. Node engine compatibility is preserved, the Nix hash is updated, and the full cross-platform, security, and Nix checks pass.