[omry]

Security and routine upgrade requests now use separate proposals, so either can refresh without replacing the other. Dependency-lockfile and maintenance-configuration pushes validate committed dependencies and refresh existing proposals.

This replaces the existing caller with the released @v1 coordinated workflow. Weekly security and quarterly upgrade schedules, project configuration, and App references are preserved. Pending requests queue instead of canceling each other.

Validation: parsed YAML and preserved inputs; project/package metadata and engines verified; production fleet caller validation passed against the live @v1 contract. The shared implementation also passed all seven live lifecycle scenarios before release.

Includes the maintenance-workflow changelog fragment required by this repository.

Update the maintainer instructions to name the installed Actions entry, Node dependency maintenance. The caller behavior and trigger changes are unchanged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-20T18:06:38.224534Z	f148ab9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Push-triggered maintenance now validates dependencies and refreshes proposals with write permissions, potentially creating unintended pull requests or issues.

Replaces the existing maintenance caller with the released @v1 coordinated workflow, so security and routine upgrade requests now use separate proposals that can refresh independently. Weekly security and quarterly upgrade schedules, project configuration, and App references are preserved, and pending requests queue instead of canceling each other. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}