[savvy-web-bot]

Promote dependency updates

Automated promotion of dependency updates accumulated on dev into main.
Triggered by merged dependency PR #534.

This PR is left open so cloud reviewers and the action's smoke tests can
run against the changes before release. Merging it starts the normal
release cycle.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​okfit/​plugin@​0.5.26 ⏵ 0.5.27	+6		+1	+1
	@​effected/​github-actions@​0.28.2 ⏵ 0.29.0	+1		+1	+1
	@​effected/​lockfiles@​0.19.5 ⏵ 0.20.0	+1			+1
	@​savvy-web/​silk@​4.5.3 ⏵ 4.5.4	+1
	@​vitest-agent/​plugin@​6.0.1 ⏵ 6.0.3				+1
	@​savvy-web/​github-action-builder@​2.4.22 ⏵ 2.4.23	+3		+1	+1
	@​effected/​yaml@​0.25.1 ⏵ 0.26.0				+1
	@​effected/​pnpm-plugin-effect@​0.18.8 ⏵ 0.19.0	+6		+1	+1
	@​effect/​platform-node@​4.0.6 ⏵ 4.0.7			+1
	@​effected/​memfs@​0.20.0 ⏵ 0.21.0	+4		+1	+1
	@​effected/​workspaces@​0.39.1 ⏵ 0.40.0	+6		+1	+1
	@​effected/​jsonc@​0.20.1 ⏵ 0.21.0	+7		+1	+1
	@​effected/​semver@​0.18.0 ⏵ 0.19.0				+1
	@​effected/​commands@​0.17.0 ⏵ 0.18.0	+6		+1	+1
	@​effected/​npm@​0.27.1 ⏵ 0.28.0	+8		+1	+1
	effect@​4.0.6 ⏵ 4.0.7			+1
	@​effect/​vitest@​4.0.6 ⏵ 4.0.7	+1		+1	+1

View full report

[savvy-web-bot]

Code Review

Current Commit: 0e7c9a33b07037d970e958025817cdfd5644fdcd

Summary

Automated dependency-promotion PR (dev → main). The in-scope changes are a clean, internally consistent dependency bump. dist/ and pnpm-lock.yaml churn is out of scope and was not reviewed.

In-scope changes reviewed:

• pnpm-workspace.yaml — config dependency @effected/pnpm-plugin-effect 0.18.8 → 0.19.0. This is the single source that drives the catalog:effected / catalog:effect version pins.
• package.json — four devDependency bumps: @okfit/plugin 0.5.26→0.5.27, @savvy-web/github-action-builder 2.4.22→2.4.23, @savvy-web/silk 4.5.3→4.5.4, @vitest-agent/plugin 6.0.1→6.0.3. Tooling-only (build/lint/test), so no changeset entry is warranted for these.
• .changeset/savvy-web-silk-runtime-action-deps.md — patch bump documenting the catalog-resolved runtime dependency updates.

Consistency check — passes: The changeset table matches the lockfile catalogs: block exactly (effect/@effect/platform-node 4.0.7; @effected/commands 0.18.0, github-actions 0.29.0, jsonc 0.21.0, lockfiles 0.20.0, npm 0.28.0, semver 0.19.0, workspaces 0.40.0, yaml 0.26.0). The catalog-driven model is exactly as documented in CLAUDE.md: @effected/* ranges stay catalog:effected in package.json and resolve through the config-dependency bump rather than appearing as direct manifest edits.

Validation checks (all ✅):

Check	Result
Tests	success (620 passed, 0 failed)
Code Quality	success
Markdown	success
Conventional Commits	success
PR Title Validation	success

Verdict

No issues found. The changeset is accurate, the version math reconciles against the lockfile, and the full suite is green.

Not submitting a formal approval: this PR was opened by savvy-web-bot[bot], and GitHub rejects self-approval — maintainers will merge to start the release cycle.

Signed-off-by: C. Spencer Beggs spencer@savvyweb.systems