chore(deps): land the Renovate backlog as one validated sweep

[anconina]

Description

Consolidates the six Renovate PRs that carried real value into one validated change, so the backlog lands as a single reviewable diff and a single CI run instead of six stale ones. Every commit is scoped to one concern, so a revert stays surgical.

Supersedes #286, #287, #336, #337, #338, #340.

Commit	Supersedes	Change
chore(deps): update github actions	#286	actions/checkout, actions/setup-node, github/codeql-action, docker/* SHA pins
chore(deps): update docker images	#287	node:22-bookworm-slim + nginx:alpine base digests
fix(deps): update patch updates	#336	hono 4.12.31, vitest + coverage-v8 4.1.10, sharp 0.35.3, jose 6.2.4, ws 8.21.1, mailparser 3.9.14, @clack/core 1.4.3, iconv-lite 0.7.3, impit 0.14.3, linkedom 0.18.13, lru-cache 11.5.2, p-queue 9.3.3, vite 8.1.5, pnpm 10.34.5
chore(deps): update pnpm override typebox to 1.3.6	#338	pnpm.overrides.typebox
chore(deps): drop the obsolete sharp exports patch…	—	see below
chore(deps): move the website to astro 7.1.0 and tailwind 4.3.3	#337, #340	website manifest + its audited-release guard
test(architecture): pin the Dockerfile corepack pnpm version…	—	see below

Three things the bot branches could not do on their own

#336 shipped no lockfile. Renovate's artifact step failed, so the overrides block moved without pnpm-lock.yaml and every frozen install died on ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. The lockfile is regenerated here.

The sharp patch had to go. Bumping sharp to 0.35.3 orphaned patches/sharp@0.35.0.patch, which pnpm rejects outright with ERR_PNPM_UNUSED_PATCH. The patch existed only to add a types condition to sharp's exports map, and 0.35.3 ships that natively, so it is deleted rather than rebased. One less local patch to carry.

Deleting it surfaced a guard asserting the patch's exact output: packages/agent's architecture test required exports["."].types === "./lib/index.d.ts". Its own stated intent is that declarations be reachable through the exports map so TypeScript NodeNext does not scan ancestor node_modules — and 0.35.3 satisfies that better, publishing types inside each condition so ESM and CJS get separate declaration files. The guard now accepts either shape and additionally checks the declaration files exist, rather than pinning a literal that turns any upstream restructuring into a false failure. build:clean passing with the patch gone is the ground truth that resolution still works.

The astro guard blocks its own bump. website/scripts/check-site.mjs asserts the exact astro version it has audited, so the version and the guard must move together or the guard rejects the release it is meant to certify.

New guard: Dockerfile pnpm pin

#336 moved root packageManager to pnpm@10.34.5, but the four corepack prepare pnpm@… pins in Dockerfile, Dockerfile.install, and Dockerfile.web stayed at 10.34.4 — an image would then run --frozen-lockfile under a pnpm that did not write the lockfile. pnpm validate never reads a Dockerfile, so this drift is invisible to every deterministic gate and surfaces only in the Docker Release workflow, the same blind spot as the @comis/observability-otel COPY-list drift.

test/architecture/dockerfile-pnpm-version.test.ts makes it a static, cross-platform invariant caught under test:coverage.

typebox snapshot

tool-registry-parity.test.ts keys its snapshot by TypeBox version and never cross-compares, so the bump writes tool-registry.typebox-1.3.6.snap. Its bytes are identical to the 1.2.8 snapshot — exactly the parity the test exists to prove, i.e. 1.3.6 alters not a single generated tool schema. The 1.2.8 file is unreachable once the override moves, so it is retired rather than left to accumulate per bump.

Deliberately not included

#343 (@hono/node-server 2.0.12) is closed, not merged. @hono/node-ws has published no 2.x — latest is 1.3.1, still declaring peerDependencies: { "@hono/node-server": "^1.19.11" }. Both are pinned together in packages/comis and packages/gateway, so the bump puts an unsatisfiable peer in the published manifest: pnpm warns, npm install fails with ERESOLVE, and the installer's bundled-dependency repair pass dies — the regression #350 just fixed. The advisory stays open until upstream ships a compatible @hono/node-ws.

The website's three high-severity advisories remain open. They are transitive — sharp (<0.35.0, libvips CVEs) and svgo (4.0.0–4.0.1) under the astro tree — so astro 7.1.0 does not clear them despite the [security] label on #340. They need their own resolution pass, kept out of a dependency-cleanup PR.

#311 and #312 (lock-file maintenance) are closed as stale churn. No security content, and both were cut against lockfiles main has moved past twice. Renovate will regenerate them against this tip.

Related Issue

N/A: dependency-manifest, lockfile, CI-pin and Dockerfile-pin maintenance consolidating existing bot PRs. The one behavior-adjacent edit is the new architecture guard plus widening a stale assertion in an existing guard; no runtime source changes.

Type of Change

• Bug fix — unbreaks the patch-update batch (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH) and the astro bump (self-blocking version guard)
• New feature
• Breaking change
• Documentation
• Refactor

Checklist

• Targeted checks for the changed area pass
• Full repository validation passes (pnpm validate)
• New or changed behavior has a test that demonstrated the RED state before the production change
• Documentation updated (if applicable) — swept docs/** for every version moved; no doc pins these (release versions were de-pinned repo-wide), so no doc change is due
• No secrets or credentials committed
• Security implications considered — see the fix(deps): update dependency @hono/node-server to v2.0.12 [security] #343 peer analysis and the residual transitive advisories below
• The change is focused on one concern and links the related issue, or states the allowed N/A reason

RED Test Proof

test/architecture/dockerfile-pnpm-version.test.ts against the unfixed Dockerfiles, before moving the pins:

 × every corepack pnpm pin matches the packageManager version in root package.json 4ms
⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
 FAIL  |architecture| dockerfile-pnpm-version.test.ts > Dockerfile corepack pnpm pins > every corepack pnpm pin matches the packageManager version in root package.json
AssertionError: Dockerfile pnpm pins drifted from the declared packageManager. An image built this way installs a frozen lockfile with a pnpm that did not write it. Move every pin together:
Dockerfile:21 pins pnpm@10.34.4 but package.json declares pnpm@10.34.5
Dockerfile:248 pins pnpm@10.34.4 but package.json declares pnpm@10.34.5
Dockerfile.install:37 pins pnpm@10.34.4 but package.json declares pnpm@10.34.5
Dockerfile.web:8 pins pnpm@10.34.4 but package.json declares pnpm@10.34.5: expected [ …(4) ] to deeply equal []
 Test Files  1 failed (1)
      Tests  1 failed | 1 passed (2)

The sharp guard's RED state, from the first full pnpm validate after the patch was deleted:

 FAIL  |@comis/agent| src/__tests__/architecture.test.ts > @comis/agent -- architecture invariants > installed sharp exposes declarations through its package exports
AssertionError: sharp must export its bundled declarations so TypeScript NodeNext resolution does not depend on ancestor node_modules: expected undefined to be './lib/index.d.ts'
 ❯ src/__tests__/architecture.test.ts:382:7
 Test Files  1 failed | 2321 passed | 34 skipped (2356)
      Tests  1 failed | 41127 passed | 131 skipped (41259)

Both green after the fixes, in a full run:

VALIDATE_EXIT=0
check-cycles: 0 circular dependencies across 16 dist packages
 Test Files  2323 passed | 34 skipped (2357)
      Tests  41130 passed | 131 skipped (41261)

Evidence and Residual Risk

• Contribution path: not applicable — dependency and build-pin maintenance, no workload or attack-path change
• Evidence level: deterministic test — full pnpm validate (docs:check, build:clean, cycles, cycles:refs, lint:security, test:coverage) plus website && npm run validate; both architecture guards shown RED then GREEN
• Tested profile: macOS 25.3 (darwin arm64), Node 22.21.1, pnpm 10.34.5, no sandbox; existing workspace state, clean-room build via build:clean
• Residual risk:
  • pnpm validate is the cross-platform floor, not the full surface. The Docker image builds, the *.linux.test.ts tier (real-bwrap, skipped on macOS) and the integration/e2e/tarball tiers are covered by this PR's CI jobs, not locally. The Docker jobs matter here because both the base-image digests and the corepack pnpm pins changed.
  • The website's three high-severity transitive advisories (sharp libvips CVEs, svgo removeScripts) are untouched by this PR and remain open.
  • @hono/node-server stays on 1.19.15 with its advisory unresolved, because no @hono/node-ws accepts 2.x. Revisit when upstream publishes one.
  • All pins remain exact; no ^/~ was introduced, so the supply-chain invariants in CLAUDE.md are preserved and their guard tests pass.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​clack/​core@​1.4.3
	@​vitest/​coverage-v8@​4.1.10
	vitest@​4.1.10
	mailparser@​3.9.14
	tailwindcss@​4.3.2 ⏵ 4.3.3	+1		+1	-1
	ignore@​7.0.6
	linkedom@​0.18.13
	astro@​7.0.9 ⏵ 7.1.0		+2	+1
	@​tailwindcss/​vite@​4.3.2 ⏵ 4.3.3	+1		+1	-1
	impit@​0.14.3
	jose@​6.2.4
	lru-cache@​11.5.2
	iconv-lite@​0.7.3
	p-queue@​9.3.3
	sharp@​0.35.3
	@​homebridge/​ciao@​1.3.10
	ws@​8.21.0 ⏵ 8.21.1
	typebox@​1.3.6

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm astro is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: website/package-lock.json → npm/astro@7.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@7.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report