chore(deps): clear vite advisories, align Dependabot with pnpm release-age gate, pin lint toolchain

.github/dependabot.yml

@@ -9,6 +9,19 @@ updates:
     commit-message:
       prefix: 'chore(deps)'
       prefix-development: 'chore(deps-dev)'
+    # pnpm-workspace.yaml sets minimumReleaseAge: 10080 (7 days). Without a
+    # matching cooldown here Dependabot proposes day-0 releases and its pnpm
+    # job aborts with ERR_PNPM_NO_MATURE_MATCHING_VERSION, silently dropping
+    # the rest of the group from the PR. Keep this >= minimumReleaseAge.
+    cooldown:
+      default-days: 8
+    ignore:
+      # typescript-eslint hard-throws on TS >= 7 ("typescript-eslint does not
+      # support TS 7.0") and is targeting TS >= 7.1, so no released version
+      # unblocks this. TS 7.0 is designed to run side-by-side with 6.0.
+      # Tracking: https://github.com/typescript-eslint/typescript-eslint/issues/10940
+      - dependency-name: 'typescript'
+        update-types: ['version-update:semver-major']
     groups:
       all-dependencies:
         patterns:

.github/workflows/dependabot-autoformat.yml

@@ -1,11 +1,14 @@
 name: Dependabot auto-format
 
-# Dependabot regenerates the whole lockfile on every bump, which can silently
-# move the *resolved* prettier/eslint version (within the existing semver range)
-# and reformat source files. Dependabot never runs project scripts, and its
-# commits are made via the API so they bypass the local husky/lint-staged hook.
-# The result is that `pnpm check` fails on style even though no source was
-# touched. This workflow reformats such PRs and pushes the fix back.
+# A prettier/eslint/typescript-eslint bump can reformat source files. Dependabot
+# never runs project scripts, and its commits are made via the API so they bypass
+# the local husky/lint-staged hook. The result is that `pnpm check` fails on style
+# even though no source was touched. This workflow reformats such PRs and pushes
+# the fix back.
+#
+# Those three are exact-pinned in package.json, so the version can no longer drift
+# *silently* inside a caret range on an unrelated bump — but an explicit bump of
+# one of them still needs this.
 
 on:
   pull_request:

package.json

@@ -50,16 +50,17 @@
     "@types/semver": "^7.7.0",
     "@types/xml2js": "^0.4.14",
     "@types/yargs": "^17.0.33",
-    "eslint": "^10.5.0",
+    "eslint": "10.7.0",
     "eslint-config-prettier": "^10.1.8",
     "globals": "^17.7.0",
     "husky": "^9.1.7",
     "lint-staged": "^17.3.0",
     "msw": "^2.7.5",
-    "prettier": "^3.4.2",
+    "prettier": "3.9.6",
     "ts-add-js-extension": "^1.6.6",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.61.1",
+    "typescript-eslint": "8.66.0",
+    "vite": "^8.2.1",
     "vitest": "^4.1.0"
   },
   "dependencies": {