chore(deps): stop dependabot re-proposing the typescript major

[bryanfawcett]

This PR has been reduced to one file. It originally carried the audit-gate fix and the TypeScript re-pin; #56 landed both on main first, so that work is now redundant and has been dropped rather than force-merged as a duplicate. The branch is reset onto a3a3cd0 and what remains is the one thing #56 did not do.

I verified main is genuinely fixed rather than assuming it — in a clean worktree at a3a3cd0: pnpm audit --audit-level=high → No known vulnerabilities found, pnpm -r build → complete, 58 pages. #56's typescript: ^6.0.0 entry in pnpm.overrides is also a better mechanism than the package.json pin this PR originally proposed, because it forces the whole tree rather than the four direct declarations.

What is left

A Dependabot ignore for typescript semver-major.

Why it is still worth having, given the override

The history is the argument:

1. 0e520fc pinned TypeScript to 6.x deliberately — TS 7 is the Corsa/native rewrite, its entrypoint no longer re-exports the classic compiler API, ts.sys is undefined, and svelte2tsx crashes emitting .d.ts for nyuchi-docs-search.
2. Six days later the majors group reverted that pin in chore(deps): bump the majors group with 3 updates #54 and broke the build.
3. Nobody noticed, because build.yml runs pnpm audit ahead of pnpm -r build and the audit gate was already red — the build step never executed.

With the override in place, a repeat bump is now inert. That is exactly why it is worth suppressing rather than tolerating: the next such PR would look harmless and merge clean, leaving package.json declaring ^7 while overrides force ^6. That inconsistency is an invitation for someone to "tidy up" the override — and then the build breaks for real, with the misleading commit already buried.

A decision a bot can re-propose every week is a decision that has to be re-made every week.

Exit condition, stated in the file

Drop this entry together with the override when svelte2tsx supports the TS 7 API. Not before, and not one without the other.

Verification

dependabot.yml parses; both the minor-and-patch and majors groups are intact and unchanged.

One correction worth keeping

The original version of this PR found that CLAUDE.md was wrong about the js-yaml advisory — it claimed the fix "can't be fixed without breaking" because the patched line "drops the ESM default export Astro imports". js-yaml 5.x dropped that export; an unbounded >=4.3.1 simply resolved across the major into it. #56 reached the same place via js-yaml@4: ^4.3.1, which is equivalent and tidier. The general rule is worth stating wherever that note now lives: bound every override below the next major — a range that crosses one is not a security override, it is an unreviewed upgrade.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01KQPxAPY7KvsN9WLbdLSQED

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	shamwari-docs-ai	db5d817	Commit Preview URL Branch Preview URL	Aug 10 2026, 09:55 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	nyuchi-docs-mcp	db5d817	Commit Preview URL Branch Preview URL	Aug 10 2026, 09:55 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	nyuchi-docs	db5d817	Commit Preview URL Branch Preview URL	Aug 10 2026, 09:56 PM

[bryanfawcett]

This overlaps #56, and the two will conflict. Flagging before either merges.

Both PRs untrack CLAUDE.md + .claude/skills/* and both edit pnpm.overrides + pnpm-lock.yaml, so whichever merges second conflicts on those two files.

Two differences that matter:

1. This branch does not fix the build. It is 14 commits behind main (2 ahead). Its typescript: ^6.0.3 looks like a fix but is just the pre-bump value carried along — main is on ^7.0.2, and a merge keeps main's version. So pnpm -r build stays broken afterwards.

That break is not cosmetic: main's build.yml has failed on every run since 5 Aug and the docs site has not deployed since. No released svelte2tsx supports TypeScript 7 (latest, 0.7.59, peers ^4.9.4 || ^5 || ^6), so svelte-package dies with Cannot read properties of undefined (reading 'fileExists') and takes site down with it. #56 pins TypeScript back to ^6.0.0 with a matching override and builds all 58 pages.

2. The nanoid override here is looser than intended. "nanoid@<3.3.17": ">=3.3.17" has no upper bound, so it resolves to nanoid 6.0.1 — visible in this PR's lockfile, where postcss picks it up. That is a major jump to satisfy a patch advisory, and nanoid 6 requires node ^22 || ^24 || >=26. #56 uses "nanoid@3": "^3.3.17", which stays inside 3.x.

The undici and js-yaml overrides are equivalent in both.

Suggested resolution: close this in favour of #56, which is cut from current main, carries the same untracking, and is verified green — audit clean, 58 pages built, all four packages' tests passing, and all three Cloudflare Workers deployed. Nothing here appears to be lost by doing so, but shout if this branch carries mzizi-skills-publishing work I have not spotted, and I will reconcile rather than discard.

---

Generated by Claude Code