## What
Applies the safe updates from dependabot #348 (`npm-minor-patch` group)
and **excludes the one bump that breaks the build**, `tree-sitter`.
| Package | From | To |
| --- | --- | --- |
| prettier | 3.8.3 | 3.8.4 |
| @clack/prompts | 1.1.0 / 1.4.0 | 1.5.1 |
| @types/node | 25.9.0 | 25.9.3 |
| esbuild | 0.28.0 | 0.28.1 |
| semver | 7.7.4 / 7.8.0 | 7.8.4 |
| vitest | 4.1.6 | 4.1.9 |
| tree-sitter | 0.21.1 | **held at 0.21.1** |
(`ws` was part of #348's group but is already at 8.21.0 on `main`, so
it's untouched here.)
## Why tree-sitter is excluded
`tree-sitter@0.25.0` ships **no Node 24 prebuilds**, and its
`binding.gyp` forces `-std=c++17` while Node 22+ v8 (cppgc) headers
require C++20, so the native build fails `npm ci`/`npm install` on
current Node. That's exactly why #348's `ESLint` job (Node 24) fails at
install:
```
.../node_modules/tree-sitter ... node-gyp-build
.../include/node/v8config.h:13:2: error: #error "C++20 or later required."
```
(#348's `Unit tests` job is pinned to Node 20, where it still compiles —
which is why that PR looks half-green.) There is no tree-sitter release
between 0.22.4 and 0.25.0, so there's no newer working version.
`^0.21.1` ships N-API prebuilds (no compile) and installs cleanly on
Node 20 / 22 / 24.
This PR also adds a Dependabot `ignore` for tree-sitter minor/major so
the group stops re-proposing the broken bump. Patch updates stay
allowed; drop the ignore once upstream restores prebuilt binaries.
## Verification (local)
- Lockfile regenerated on **Node 20 / npm 10.8.2** (`npm install
--package-lock-only --ignore-scripts`), idempotent under a re-run —
won't trip the strict lockfile check. tree-sitter resolves to 0.21.1
(prebuilt, no native compile).
- Full CI-equivalent on **Node 20**: `tsc --build`, `eslint
--max-warnings 0`, `prettier --check`,
`typecheck:tests`/`typecheck:scripts`, full unit suite incl. **1250
tool-server tests** — all green.
- `npm ci` from the committed lockfile succeeds.
- **Live device E2E**: ran the built tool-server with the bumped deps,
captured a real screenshot of a booted iPhone 16 Pro Max
(`simulator-client` uses `ws`), then downloaded the PNG artifact over
HTTP — `200`, 331 KB PNG.
Supersedes #348 (Dependabot auto-closes it once the safe bumps land and
tree-sitter is ignored).
## Summary
- Adds `.github/dependabot.yml` to enable weekly version + security
updates.
- Covers the **npm workspaces monorepo** (`/` + `/packages/*`) and
**GitHub Actions** used in `.github/workflows`.
- Groups updates to keep PR noise low:
- `npm-minor-patch` — one PR/week bundling all minor/patch bumps across
the workspace.
- `npm-major` — separate grouped PR for majors (typically needs human
review).
- `npm-security` — grouped security updates across all directories.
- `github-actions` — one PR/week for all Actions bumps.
- Uses `directories:` (plural) with the `/packages/*` glob so every
workspace package is monitored; majors stay separate from minor/patch so
reviewers can triage breaking changes without blocking routine bumps.
- `gitsubmodule` ecosystem was intentionally **not** enabled —
`packages/argent-private` is an internal submodule maintained by the
same org, so SHA-bump PRs would be noise rather than signal.
## Notes
- Schedule: weekly, Monday 06:00 UTC.
- Commit prefixes follow the existing `chore(...)` convention used in
this repo (`chore(deps)`, `chore(deps-dev)`, `chore(ci)`).
- `open-pull-requests-limit` set to 10 (npm) / 5 (actions) to bound the
queue.
## Test plan
- [ ] Merge to `main`; confirm Dependabot picks up the file (visible
under repo *Insights → Dependency graph → Dependabot*).
- [ ] First scheduled run on the following Monday produces grouped PRs
(or trigger immediately via *Check for updates* in the Dependabot tab).
- [ ] Verify a sample PR's diff touches the expected workspace
`package.json` + root `package-lock.json`.
Ignacy Łątka