deps: clear 14 pnpm advisories and land the weekly dep groups

.github/actions/setup-env/action.yml

@@ -112,7 +112,7 @@ runs:
     # All Go jobs miss this key together on a dependency bump and all try to
     # save; the backend keeps the first and the rest log a benign "already
     # exists" (same trade-off as the rest of the inventory, see header).
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ inputs.go == 'true' }}
       id: gomod-cache
       with:
@@ -140,7 +140,7 @@ runs:
     # (~/go/pkg/mod moved out, above). Saves only happen on an exact-key
     # miss, so without a bump the old v2 entry would exact-hit forever and
     # the new, smaller content would never be saved.
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ inputs.go == 'true' }}
       id: gobuild-cache
       with:
@@ -167,7 +167,7 @@ runs:
         restore-keys: |
           gobuild-v3-${{ runner.os }}-go${{ inputs.go-cache-suffix }}-
 
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ inputs.golangci == 'true' }}
       id: golangci-cache
       with:
@@ -196,10 +196,10 @@ runs:
 
     # pnpm must install before its cache step so the store path can be
     # resolved from pnpm itself.
-    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+    - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       if: ${{ inputs.node == 'true' }}
       with:
-        version: "11.1.3"
+        version: "11.21.0"
         run_install: false
 
     - name: Resolve pnpm store directory
@@ -208,7 +208,7 @@ runs:
       shell: bash
       run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
 
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ inputs.node == 'true' }}
       id: pnpm-cache
       with:
@@ -222,7 +222,7 @@ runs:
     # Chromium during install-playwright-docs — adds 30-60s per run. Keyed
     # on the root pnpm-lock.yaml since that's where the Playwright version
     # is locked. Closes the Playwright half of #132.
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ inputs.playwright == 'true' }}
       id: playwright-cache
       with:
@@ -238,7 +238,7 @@ runs:
     # the cache shape; intra-key content changes are caught by Astro's
     # own file-hash check inside data-store.json. Closes the build-cache
     # half of #132.
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       if: ${{ inputs.astro == 'true' }}
       id: astro-cache
       with:
@@ -247,7 +247,7 @@ runs:
         restore-keys: |
           astro-${{ runner.os }}-
 
-    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       if: ${{ inputs.node == 'true' }}
       with:
         node-version-file: ".nvmrc"

.github/dependabot.yml

@@ -13,8 +13,19 @@ updates:
       prefix: "deps"
 
   # GitHub Actions
+  #
+  # TWO directories, not one. `directory: /` only reaches .github/workflows/ —
+  # it does NOT descend into .github/actions/*/action.yml. The setup-env
+  # composite action therefore went untracked, and its pins went stale against
+  # upstream and diverged from publish-npm.yml — a workflow Dependabot DOES
+  # track, and which doesn't call setup-env (actions/setup-node v7.0.0 there
+  # vs v6.4.0 here; pnpm/action-setup v6.0.9 vs v6.0.8). Adding a composite
+  # action under .github/actions/ means adding its directory below; nothing
+  # else catches the drift.
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - /
+      - /.github/actions/setup-env
     schedule:
       interval: weekly
       day: monday
@@ -52,5 +63,16 @@ updates:
     groups:
       npm-deps:
         patterns: ["*"]
+    ignore:
+      # TypeScript 7 (the native port) is held back by tsup: tsup 8.5.1 — the
+      # current release — vendors rollup-plugin-dts 6.1.1, which reaches for
+      # TS 5-era internals and dies with "Cannot read properties of undefined
+      # (reading 'useCaseSensitiveFileNames')" the moment `dts: true` runs.
+      # That is clients/ts's `prepare` script, so the crash lands inside
+      # `pnpm install` and takes every Node job down with it (#482).
+      # rollup-plugin-dts >= 6.5.0 declares TS 7 support; drop this ignore once
+      # tsup ships a release that vendors it. Tracked in #487.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
     commit-message:
       prefix: "deps"

.github/workflows/ci.yml

@@ -389,7 +389,7 @@ jobs:
              github.event.pull_request.head.repo.full_name == github.repository)
           ) }}
         continue-on-error: true
-        uses: actions/upload-code-coverage@1c15be36fc3733ba839b1dd643bd9556e4426dc1 # v1.4.1
+        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
         with:
           file: tmp/coverage/go-coverage.xml
           language: go

.github/workflows/housekeeping.yml

@@ -56,7 +56,12 @@ jobs:
       # `sync-labels: true` removes labels when their matching files
       # leave the diff, so labels track the current change set.
       - name: Apply file-path labels
-        uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+        # Non-fatal on purpose (the header's contract): labeling is a
+        # convenience, the title mirror below is the point. Without this a
+        # transient labeler API 500 aborts the job before the mirror runs —
+        # which is exactly what reddened #481.
+        continue-on-error: true
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           configuration-path: .github/labeler.yml
           sync-labels: true

.github/workflows/publish-dev.yml

@@ -74,7 +74,7 @@ jobs:
       # other can't use. Same `gobuild-v3` family and key inputs as
       # setup-env's (see .github/workflows/README.md); ~0.5 GB rather than
       # the ~1 GB the bundled cache held.
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/go-build
           key: gobuild-v3-${{ runner.os }}-go-release-${{ hashFiles('**/go.mod', '**/go.sum') }}
@@ -91,7 +91,7 @@ jobs:
       # shares — it never runs `go mod download` for the full graph (see the
       # cov note in the Makefile for why a partial save there is corrosive).
       # Restore-only writes nothing, so it costs 0 GB of the budget.
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/go/pkg/mod
           key: gomod-v1-${{ runner.os }}-${{ hashFiles('**/go.mod', '**/go.sum') }}
@@ -107,7 +107,7 @@ jobs:
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -150,7 +150,7 @@ jobs:
           echo "Resolved $ref -> $digest"
 
       - name: Attest dev image provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-name: ghcr.io/wave-rf/wavehouse
           subject-digest: ${{ steps.image.outputs.digest }}

.github/workflows/publish-npm.yml

@@ -48,9 +48,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
-          version: "11.1.3"
+          version: "11.21.0"
           run_install: false
 
       # Node 24 ships npm >= 11.5.1 for OIDC trusted publishing, and dodges the
@@ -102,9 +102,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
-          version: "11.1.3"
+          version: "11.21.0"
           run_install: false
 
       # Node 24 ships npm >= 11.5.1 for OIDC trusted publishing — see the dev job.

.github/workflows/release.yml

@@ -57,7 +57,7 @@ jobs:
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -78,7 +78,7 @@ jobs:
       # in goreleaser's checksums.txt. Image: attest the multi-arch
       # manifest-list digest and store the attestation alongside it in GHCR.
       - name: Attest binary provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-checksums: dist/checksums.txt
 
@@ -94,7 +94,7 @@ jobs:
           echo "Resolved $ref -> $digest"
 
       - name: Attest image provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-name: ghcr.io/wave-rf/wavehouse
           subject-digest: ${{ steps.image.outputs.digest }}

AGENTS.md

@@ -111,7 +111,7 @@ Tooling notes (the non-obvious bits `make help` won't tell you):
 
 - Dev tools (`gotestsum`, `gofumpt`, `goimports`, `govulncheck`, `go-test-coverage`, `gocover-cobertura`, `deadcode`, `gsa`, `goda`) are pinned in `go.mod` via `tool` directives — `go tool <name>`, no manual install.
 - `golangci-lint` is pinned in the Makefile (v2.11.4), auto-installed to `.bin/` on first `make lint` — kept out of `go.mod` (its deps conflict with the main module).
-- `pnpm` (≥ 11.1) + `Node 22 LTS` (`.nvmrc`, matches CI) must be on PATH; `make tools` runs one root `pnpm install --frozen-lockfile` across the three workspaces (SDK `clients/ts/`, E2E `tests/e2e/sdk/`, docs `docs/`).
+- `pnpm` (≥ 11.21) + `Node 22 LTS` (`.nvmrc`, matches CI) must be on PATH; `make tools` runs one root `pnpm install --frozen-lockfile` across the three workspaces (SDK `clients/ts/`, E2E `tests/e2e/sdk/`, docs `docs/`).
 - **GNU Make 4+** required (uses `--output-sync=target`); macOS BSD Make 3.81 won't parse it. Full setup: `docs/src/content/docs/development.md` § Prerequisites.
 - **Lint split**: Biome owns JS/TS/JSON, markdownlint owns Markdown *style*, misspell owns spelling (all under `make lint`/`make fix`); accuracy/clarity/doc-sync is the `docs-reviewer` gate (§Docs review).
 - **Worktrunk** (`wt`, `.config/wt.toml`): `wt switch --create` seeds `.bin/` + `node_modules/` from main, then runs `make tools`.

README.md

@@ -121,7 +121,7 @@ Track what's shipped, in progress, and planned on the [**project board**](https:
 
 ## 💻 Local Development
 
-You'll need **Go 1.26+, GNU Make 4+, Docker (Compose v2), Node.js 22 LTS, and pnpm 11+**. See [development docs](https://wavehouse.dev/development) for the authoritative source of truth with the full list, version requirements, and gotchas.
+You'll need **Go 1.26+, GNU Make 4+, Docker (Compose v2), Node.js 22 LTS, and pnpm 11.21+**. See [development docs](https://wavehouse.dev/development) for the authoritative source of truth with the full list, version requirements, and gotchas.
 
 ```bash
 make tools    # one-time bootstrap

clients/ts/package.json

@@ -47,7 +47,7 @@
     "@types/node": "catalog:",
     "@vitest/coverage-v8": "^4.1.10",
     "tsup": "^8.0.0",
-    "tsx": "^4.22.4",
+    "tsx": "^4.23.12",
     "typescript": "catalog:",
     "vitest": "catalog:"
   },

docs/package.json

@@ -13,7 +13,7 @@
   },
   "dependencies": {
     "@astrojs/check": "^0.9.10",
-    "@astrojs/starlight": "^0.41.6",
+    "@astrojs/starlight": "^0.41.7",
     "@astrojs/starlight-tailwind": "^5.0.0",
     "@fontsource-variable/inter": "^5.3.0",
     "@fontsource-variable/jetbrains-mono": "^5.3.0",
@@ -24,7 +24,7 @@
     "@wavehouse/sdk": "workspace:*",
     "astro": "^7.1.1",
     "astro-vtbot": "^3.0.1",
-    "katex": "^0.18.1",
+    "katex": "^0.18.4",
     "rehype-katex": "^7.0.1",
     "rehype-mermaid": "^3.0.0",
     "remark-math": "^6.0.0",

docs/src/content/docs/development.md

@@ -18,7 +18,7 @@ You need these on your `PATH` before any `make` recipe will work end-to-end:
 | **bash** | 4+ recommended | Recipes are pinned to `bash`; the helper scripts under `scripts/` use `set -euo pipefail` and bash arrays | macOS default is bash 3.2 (works for current recipes, but `brew install bash` is safer); Linux distros ship 4+ |
 | **Docker** *(or Podman)* | Engine 20.10+ with the Compose **v2** plugin (`docker compose`, no hyphen) | Compose stacks under `deployments/compose/`; the E2E and integration suites boot ClickHouse via testcontainers (no compose file) | [Docker Desktop](https://docs.docker.com/get-docker/), [colima](https://github.com/abiosoft/colima), or [Podman](https://podman.io) with `podman-compose` / the `podman compose` plugin. The testcontainers Go library also honors `DOCKER_HOST` for rootless Podman setups |
 | **Node.js** | 22 LTS — pinned via `.nvmrc` at the repo root | Runtime for pnpm and the Vitest suites. Pinned to match CI (`setup-node` uses 22) and to avoid Node-major surprises; older Vitest versions in this repo were known to crash on Node 26 with a V8 heap-allocation abort | [nodejs.org](https://nodejs.org/) or `nvm use` / `fnm use` / `volta` (all read `.nvmrc`) |
-| **pnpm** | 11.1+ (pinned via `packageManager` in the root `package.json`) | Package manager for the TypeScript SDK, E2E test harness, and docs site (managed as a single pnpm workspace from the repo root); `make build-ts`, `make test-ts`, `make test-e2e`, `make build-docs`, `make dev-docs`, `make preview-docs` all shell out to `pnpm` | `corepack enable && corepack prepare pnpm@11.1.3 --activate` (recommended), or `npm i -g pnpm` |
+| **pnpm** | 11.21+ (pinned via `packageManager` in the root `package.json`) | Package manager for the TypeScript SDK, E2E test harness, and docs site (managed as a single pnpm workspace from the repo root); `make build-ts`, `make test-ts`, `make test-e2e`, `make build-docs`, `make dev-docs`, `make preview-docs` all shell out to `pnpm` | `corepack enable && corepack prepare pnpm@11.21.0 --activate` (recommended), or `npm i -g pnpm` |
 | **git** + **curl** | any recent | `git` for source + version metadata in builds; `curl` is used by the Makefile to fetch the pinned `golangci-lint` binary into `.bin/` | usually preinstalled |
 
 ### Auto-installed by `make tools`
@@ -37,7 +37,7 @@ go version          # go1.26+
 make --version      # GNU Make 4.x
 docker compose version
 node --version      # v22.x (matches .nvmrc and CI)
-pnpm --version      # 11.1+
+pnpm --version      # 11.21+
 ```
 
 If any of those are wrong/missing, the Makefile recipes will fail with confusing errors (e.g. `--output-sync` is unrecognized on Make 3.81; `pnpm: command not found` on `make test-ts`).
@@ -556,11 +556,15 @@ For a combined security scan, run `make verify` — it runs `vulncheck` alongsid
 Dependabot is configured in `.github/dependabot.yml` to open weekly grouped PRs for three update configs:
 
 - **Go modules** (root) — outdated or vulnerable Go dependencies, commit prefix `deps:`
-- **GitHub Actions** (root) — outdated action versions tracked against the SHA pins in `ci.yml` / `release.yml`, commit prefix `ci:`
+- **GitHub Actions** (root **and** `/.github/actions/setup-env`) — outdated action versions tracked against the SHA pins across `.github/workflows/*` and the `setup-env` composite action, commit prefix `ci:`
 - **npm — pnpm workspace** (root) — covers all three TypeScript packages (the docs site, the SDK, and the E2E tests) in one grouped PR, commit prefix `deps:`
 
 PRs are grouped per config to reduce noise. The npm config is pointed at the workspace **root** (`directory: /`), not the individual member directories. The repo has a single root `pnpm-lock.yaml`, and Dependabot only updates a lockfile co-located with the manifest it targets — so a per-member config (the previous setup) bumped a member's `package.json` without regenerating the root lockfile, and every such PR then failed CI's `pnpm install --frozen-lockfile` with `ERR_PNPM_OUTDATED_LOCKFILE`. Pointing at the root lets Dependabot read `pnpm-workspace.yaml`, walk every member, and update the one lockfile.
 
+The GitHub Actions config names **two** directories. `directory: /` reaches `.github/workflows/` but does not descend into `.github/actions/*/action.yml`, so the `setup-env` composite action — which owns every cache in `ci.yml` — was invisible to Dependabot, and its pins went stale against upstream and diverged from `publish-npm.yml`, which Dependabot *does* track and which doesn't call `setup-env`. Listing its directory under `directories:` brings it into the same weekly group; **adding a composite action means adding its directory there**, because nothing else catches the drift.
+
+`typescript` majors are held back (`ignore: version-update:semver-major`) because `tsup` vendors a `rollup-plugin-dts` that crashes on TypeScript 7 during `clients/ts`'s `prepare` script — i.e. inside `pnpm install`, which takes every Node job down at once. See the comment in `.github/dependabot.yml` for the condition that lets it be removed.
+
 **No auto-merge.** Dependabot PRs go through the same merge gate as any other PR — an approval from the `@Wave-RF/wavehouse-admins` team (the ruleset's `required_reviewers` rule) plus the required checks. (The former `dependabot-automerge.yml`, which auto-approved and merged patch/minor bumps hands-off, was removed — every bump now gets a human admin review.)
 
 ## Releasing the SDK