chore(deps): batch four Dependabot updates and fix the workspace-member config defect

.github/dependabot.yml

@@ -11,8 +11,28 @@
 # Note: the rev-1 config opened 21 individual first-run PRs because it had
 # no grouping and a misleading "security-only" comment that the config
 # never enforced. Grouping fixes both.
+#
+# rev 3 (2026-08-13): DELETED the `/server/mcp` and `/server/content`
+# entries. Both are pnpm WORKSPACE MEMBERS (pnpm-workspace.yaml), so they
+# have no lockfile of their own — the root `pnpm-lock.yaml` is the only one
+# that resolves them. A per-directory entry can only rewrite that member's
+# `package.json`, never the root lockfile, so every PR it opened was born
+# failing `pnpm install --frozen-lockfile` with ERR_PNPM_OUTDATED_LOCKFILE
+# and could not be merged by any means short of a hand-written lockfile
+# commit. Six such PRs were opened and five were closed unmerged (#1259,
+# #1239, #1237, #1189, #1167, #1166) before the mechanism was identified.
+#
+# The `/` entry above already covers both members — Dependabot resolves the
+# whole workspace from the root manifest and updates member `package.json`
+# files together with the root lockfile in ONE consistent PR. Verified on
+# #1261, whose file list is package.json + pnpm-lock.yaml +
+# server/content/package.json + server/mcp/package.json, and which carried
+# byte-identical (indeed newer) bumps to the two PRs that could not merge.
+# Do not re-add a per-member entry: it cannot produce a mergeable PR.
 version: 2
 updates:
+  # Root manifest AND every pnpm workspace member (server/mcp, server/content),
+  # because they all resolve through the root pnpm-lock.yaml. See rev-3 note.
   - package-ecosystem: npm
     directory: /
     schedule:
@@ -25,35 +45,22 @@ updates:
       # @types/node tracks the Node runtime major (22 — CI, dev, and the
       # pkg-compiled sidecar all run 22). Majors are bumped manually when
       # the runtime moves, not by Dependabot (#1101/#1094, 2026-07).
+      # Applies workspace-wide: server/mcp pins @types/node too.
       - dependency-name: "@types/node"
         update-types: ["version-update:semver-major"]
 
-  - package-ecosystem: npm
-    directory: /server/mcp
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    groups:
-      npm-minor-patch:
-        update-types: ["minor", "patch"]
-    ignore:
-      # Same @types/node policy as the root manifest above.
-      - dependency-name: "@types/node"
-        update-types: ["version-update:semver-major"]
-
-  - package-ecosystem: npm
-    directory: /server/content
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    groups:
-      npm-minor-patch:
-        update-types: ["minor", "patch"]
-    ignore:
-      # Same @types/node policy as the root manifest above.
-      - dependency-name: "@types/node"
-        update-types: ["version-update:semver-major"]
-
+  # website/ is deliberately OUTSIDE the pnpm workspace (it is absent from
+  # pnpm-workspace.yaml and installs with --ignore-workspace), so it keeps
+  # its own website/pnpm-lock.yaml and needs its own entry — unlike the
+  # workspace members above.
+  #
+  # KNOWN GAP: Dependabot updates website/package.json but NOT
+  # website/pnpm-lock.yaml, so these PRs land a package.json the lockfile
+  # does not match. It is silent rather than red because deploy-website.yml
+  # installs website deps WITHOUT --frozen-lockfile. It has twice needed a
+  # manual repair commit (bfc7d2456, c5486c5e3). Until that is resolved,
+  # re-run `pnpm install --ignore-workspace --lockfile-only` in website/ and
+  # commit the result alongside any Dependabot bump here.
   - package-ecosystem: npm
     directory: /website
     schedule:

.github/workflows/baseline-review.yml

@@ -63,7 +63,7 @@ jobs:
           # exists to surface. Issue #1248 was filed that way.
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
       - uses: actions/setup-node@v7
         with:
           node-version: 22

.github/workflows/ci.yml

@@ -202,7 +202,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
       - uses: actions/setup-node@v7
         with:
@@ -268,7 +268,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
       - uses: actions/setup-node@v7
         with:
@@ -304,7 +304,7 @@ jobs:
       rust: ${{ steps.filter.outputs.rust }}
     steps:
       - uses: actions/checkout@v7
-      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
         id: filter
         with:
           filters: |
@@ -423,7 +423,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install cargo-audit
-        uses: taiki-e/install-action@065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e # v2.85.4
+        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
         with:
           tool: cargo-audit
 

.github/workflows/claude-audit.yml

@@ -31,7 +31,7 @@ jobs:
         with:
           fetch-depth: 1
 
-      - uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
+      - uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79 # v1
         id: claude
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

.github/workflows/claude.yml

@@ -106,7 +106,7 @@ jobs:
           fetch-depth: 1
           token: ${{ secrets.PAT_TOKEN }}
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
       - uses: actions/setup-node@v7
         with:
@@ -124,7 +124,7 @@ jobs:
 
       - name: Fix issue #${{ matrix.issue }}
         id: fix
-        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79 # v1
         env:
           # Claude's gh/git commands use PAT so PRs trigger CI
           GH_TOKEN: ${{ secrets.PAT_TOKEN }}
@@ -224,7 +224,7 @@ jobs:
       # Verify the fix in a separate read-only Claude session
       - name: Verify fix for #${{ matrix.issue }}
         if: steps.find-pr.outputs.number
-        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           github_token: ${{ secrets.PAT_TOKEN }}
@@ -305,7 +305,7 @@ jobs:
         with:
           fetch-depth: 1
 
-      - uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
+      - uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79 # v1
         id: verify
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
@@ -381,7 +381,7 @@ jobs:
         with:
           fetch-depth: 1
 
-      - uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
+      - uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79 # v1
         id: claude
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

.github/workflows/deploy-website.yml

@@ -42,7 +42,7 @@ jobs:
           node-version: 22
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
       - name: Install root dependencies (lint tools)
         run: pnpm install --frozen-lockfile

.github/workflows/mutation.yml

@@ -113,7 +113,7 @@ jobs:
         run: touch "src-tauri/binaries/vmark-mcp-server-x86_64-unknown-linux-gnu"
 
       - name: Install cargo-mutants
-        uses: taiki-e/install-action@065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e # v2.85.4
+        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
         with:
           tool: cargo-mutants
 
@@ -150,7 +150,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
       - uses: actions/setup-node@v7
         with:

.github/workflows/release.yml

@@ -129,7 +129,7 @@ jobs:
           node-version: 22
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch

.github/workflows/rust-coverage.yml

@@ -49,7 +49,7 @@ jobs:
         run: touch "src-tauri/binaries/vmark-mcp-server-x86_64-unknown-linux-gnu"
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e # v2.85.4
+        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
         with:
           tool: cargo-llvm-cov
 

.github/workflows/soak.yml

@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
       - uses: actions/setup-node@v7
         with:
           node-version: 22

.github/workflows/tier0-e2e.yml

@@ -106,7 +106,7 @@ jobs:
           key: rust-tier0-e2e-${{ runner.os }}-${{ hashFiles('src-tauri/Cargo.lock') }}
           restore-keys: rust-tier0-e2e-${{ runner.os }}-
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
       - uses: actions/setup-node@v7
         with:

package.json

@@ -82,16 +82,16 @@
     "lint:review-schedule": "node scripts/check-review-schedule.mjs"
   },
   "dependencies": {
-    "@actions/languageservice": "0.3.60",
-    "@actions/workflow-parser": "0.3.60",
+    "@actions/languageservice": "0.3.61",
+    "@actions/workflow-parser": "0.3.61",
     "@codemirror/autocomplete": "^6.20.3",
     "@codemirror/commands": "^6.10.4",
     "@codemirror/lang-css": "^6.3.1",
     "@codemirror/lang-go": "^6.0.1",
-    "@codemirror/lang-html": "^6.4.11",
+    "@codemirror/lang-html": "^6.4.12",
     "@codemirror/lang-javascript": "^6.2.5",
     "@codemirror/lang-json": "^6.0.2",
-    "@codemirror/lang-markdown": "^6.5.1",
+    "@codemirror/lang-markdown": "^6.5.2",
     "@codemirror/lang-python": "^6.2.1",
     "@codemirror/lang-rust": "^6.0.2",
     "@codemirror/lang-xml": "^6.1.0",
@@ -102,8 +102,8 @@
     "@codemirror/lint": "^6.9.7",
     "@codemirror/search": "^6.7.1",
     "@codemirror/state": "^6.7.1",
-    "@codemirror/view": "^6.43.7",
-    "@dagrejs/dagre": "^3.0.0",
+    "@codemirror/view": "^6.43.8",
+    "@dagrejs/dagre": "^3.1.1",
     "@joplin/turndown-plugin-gfm": "^1.0.67",
     "@lezer/highlight": "^1.2.3",
     "@panzoom/panzoom": "^4.6.2",
@@ -132,7 +132,7 @@
     "@tiptap/pm": "^3.29.2",
     "@tiptap/react": "^3.29.2",
     "@tiptap/starter-kit": "^3.29.2",
-    "@viz-js/viz": "^3.28.0",
+    "@viz-js/viz": "^3.29.0",
     "@xterm/addon-clipboard": "0.2.0",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/addon-search": "^0.16.0",
@@ -144,19 +144,19 @@
     "@xyflow/react": "12.11.2",
     "alfaaz": "^1.1.0",
     "codemirror-lang-mermaid": "0.5.0",
-    "dompurify": "^3.4.12",
+    "dompurify": "^3.4.13",
     "highlight.js": "^11.11.1",
     "html-to-image": "1.11.13",
     "i18next": "^26.3.6",
-    "i18next-resources-to-backend": "^1.2.2",
-    "katex": "^0.18.1",
+    "i18next-resources-to-backend": "^1.2.3",
+    "katex": "^0.18.3",
     "lowlight": "^3.3.0",
-    "lucide-react": "^1.27.0",
+    "lucide-react": "^1.31.0",
     "markmap-common": "^0.18.9",
     "markmap-lib": "^0.18.12",
     "markmap-view": "^0.18.12",
     "mdast-util-find-and-replace": "^3.0.2",
-    "mermaid": "^11.16.0",
+    "mermaid": "^11.16.1",
     "react": "^19.2.8",
     "react-arborist": "^3.16.0",
     "react-dom": "^19.2.8",
@@ -170,7 +170,7 @@
     "remark-parse": "^11.0.0",
     "remark-stringify": "^11.0.0",
     "smol-toml": "^1.7.1",
-    "sonner": "^2.0.7",
+    "sonner": "^2.0.8",
     "turndown": "^7.2.4",
     "unified": "^11.0.5",
     "unist-util-visit": "^5.1.0",
@@ -207,40 +207,40 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@hypothesi/tauri-mcp-server": "^0.12.0",
-    "@size-limit/file": "^13.0.2",
+    "@size-limit/file": "^13.0.3",
     "@stryker-mutator/core": "9.6.1",
     "@stryker-mutator/vitest-runner": "9.6.1",
     "@tailwindcss/vite": "^4.3.3",
     "@tauri-apps/cli": "^2.11.4",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
-    "@testing-library/user-event": "^14.6.1",
+    "@testing-library/user-event": "^14.6.3",
     "@types/mdast": "^4.0.4",
     "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "@types/turndown": "^5.0.6",
-    "@vitejs/plugin-react": "^6.0.4",
+    "@vitejs/plugin-react": "^6.0.5",
     "@vitest/browser": "^4.1.10",
     "@vitest/browser-playwright": "^4.1.10",
     "@vitest/coverage-v8": "^4.1.10",
-    "dependency-cruiser": "^18.1.0",
-    "eslint": "^10.8.0",
+    "dependency-cruiser": "^18.1.1",
+    "eslint": "^10.8.1",
     "eslint-plugin-react-hooks": "^7.1.1",
     "fast-check": "^4.9.0",
-    "globals": "^17.8.0",
+    "globals": "^17.9.0",
     "jscpd": "^5.0.14",
     "jsdom": "^30.0.1",
-    "knip": "6.29.0",
+    "knip": "6.32.0",
     "markdownlint-cli2": "^0.23.2",
     "mdast-util-math": "^3.0.0",
-    "playwright": "^1.62.0",
-    "size-limit": "^13.0.2",
+    "playwright": "^1.62.1",
+    "size-limit": "^13.0.3",
     "tailwindcss": "^4.3.3",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.11",
     "typescript": "~6.0.3",
-    "typescript-eslint": "^8.65.0",
-    "vite": "^8.1.5",
+    "typescript-eslint": "^8.66.0",
+    "vite": "^8.2.1",
     "vitest": "^4.1.10",
     "vitest-axe": "0.1.0"
   }