fix(deps): pin conventional-changelog preset to the v9 line

[cameronraysmith]

Problem

The docs release path has failed at generateNotes on every main push with a release to make since Renovate raised conventional-changelog-conventionalcommits to ^10.4.0. No release has been published by the default.release-packages effect since.

Preset major 10 requires conventional-changelog-writer major 9 or newer, but semantic-release@25.0.9 resolves @semantic-release/release-notes-generator@14.1.0, which pins writer ^8.0.0 and therefore 8.2.0.

The mechanism is not a version check but a planted handlebars template: @conventional-changelog/template@1.4.0 supplies a mainTemplate whose body is the error sentence itself. A writer-8 renderer compiles it and throws it as a Missing helper error; writer 9 ignores the option entirely. This bump did not create the incompatibility, it made an existing silent one loud.

Why pin rather than upgrade

Upgrading forward is unavailable today. Every semantic-release channel, including 26.0.0-beta.1, depends on release-notes-generator ^14.1.0, and only 15.0.0-beta.2 accepts writer 9, which no semantic-release release references.

Two other routes were eliminated by direct test rather than by reading ranges. A top-level override forcing writer 9 fails, because the package manager nests writer 8 beneath release-notes-generator to satisfy its own range and the nested copy is the one that renders. Pinning to a lower v10 also fails, since presets 10.0.0 through 10.3.0 all resolve @conventional-changelog/template to 1.4.0 today.

9.3.1 is the version upstream itself tests against writer 8, and unlike 10.4.0 it does not raise the node engine requirement to 22.

Changes

Both manifests change together because the root declares workspaces: ["packages/*"] and bun.lock keys packages by name, so one version resolves for the whole workspace.

• package.json, packages/docs/package.json: ^10.4.0 to ^9.3.1
• bun.lock, bun.nix: regenerated via nix run .#regenerate-bun-nix
• .github/renovate.json: hold the package below 10

The Renovate rule is required rather than hygiene. .github/workflows/regenerate-lock-files.yaml re-runs the generator on Renovate pull requests and amends the branch, so without the hold the next Renovate run restores ^10.4.0 and re-materializes it into bun.nix automatically. That workflow is gated to renovate[bot], so bun.nix is regenerated here by hand.

Verification

The repository's own check set does not cover this defect, and a green check set is not evidence that this is fixed. The release path runs only as a post-build effect on main, and the package-vanixiets-docs* checks never invoke generateNotes. Pull request builds are also structurally blind to it: modules/apps/docs/preview-version.sh passes --plugins, which discards the per-plugin preset: "conventionalcommits" option, and wraps the invocation in $( ... || true).

The primary evidence is therefore a paired reproduction. generateNotes from @semantic-release/release-notes-generator@14.1.0 was invoked with the repository's real pluginConfig against the repository's own bun-resolved tree over the real 9 commits since @vanixiets/docs-v0.6.0, holding writer at CI's exact 8.2.0 and changing only the preset:

preset	writer	result
10.4.0	8.2.0	fails with the CI error verbatim
9.3.1	8.2.0	renders the 0.6.1 notes correctly

The rendered output under the fix is correct, not merely non-throwing:

## [0.6.1](https://github.com/cameronraysmith/vanixiets/compare/@vanixiets/docs-v0.6.0...@vanixiets/docs-v0.6.1) (2026-08-31)

### Bug Fixes

* **deps:** update dependency @astrojs/starlight to v0.41.10 ([9a7fd54](...))

Checks run

Selected as the narrowest set that would fail if this change were wrong:

nix build --no-link --print-out-paths \
  .#checks.aarch64-darwin.{treefmt,package-vanixiets-docs-deps,package-vanixiets-docs,package-vanixiets-docs-test-unit}

All four pass. package-vanixiets-docs-deps is the derivation that materializes node_modules from bun.nix, so a stale or inconsistent lockfile fails there, and its log shows bun-pkg-conventional-changelog-conventionalcommits-9.3.1.drv. package-vanixiets-docs builds atop it, treefmt covers the changed nix and json, and -test-unit confirms the retuned tree still supports the test runner.

Deliberately left out: -test-e2e and -test-linkcheck, which exercise docs site content this diff does not touch, and the full check set, whose blast radius far exceeds a dependency pin.

Not verified

The publish step after generateNotes was not executed, since that needs the x86_64-linux closure and CI credentials. Those preconditions were already passing in the failing logs, so clearing this check is expected but not directly demonstrated.

Out of scope

The || true and --plugins override in preview-version.sh mean pull request builds cannot detect a broken production release path, which is how this reached main unnoticed. Making the preview exercise the real plugin configuration, or at least propagate its exit status, would have caught it on the Renovate pull request. Not changed here.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request