[C. Spencer Beggs (spencerbeggs)]

Signed-off-by: C. Spencer Beggs spencer@savvyweb.systems

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​savvy-web/​bundler@​0.2.0
	@​savvy-web/​silk-effects@​1.0.0
	@​savvy-web/​silk@​0.4.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: ? → npm/@savvy-web/silk@0.4.0 → npm/entities@4.5.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm jiti is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@savvy-web/vitest@1.4.0 → npm/@savvy-web/silk@0.4.0 → npm/jiti@2.6.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jiti@2.6.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[savvy-web-bot]

Code Review

Current Commit: b68a2b5

Summary

All five CI checks pass (Tests, Markdown, Code Quality, Conventional Commits, PR Title Validation). The build system migration from @savvy-web/rslib-builder → @savvy-web/bundler looks clean: rslib.config.ts is deleted, savvy.build.ts is well-structured, tsdoc.json and tsconfig.json are updated consistently, and the turbo.json task graph correctly threads the new build:meta step into the pipeline. The publishConfig.targets simplification is a nice cleanup.

One issue needs fixing before merge, plus one minor observation:

Issues

Deprecation notice text is copy-pasted from a different package

Both README.md and package/README.md say:

"Its lint-staged handlers now ship in @savvy-web/silk … savvy lint replaces savvy-lint."

This package is a changelog formatter and changeset pipeline — it has no lint-staged handlers and no savvy-lint bin. The correct migration is already documented in the changeset file (cozy-grapes-yell.md): point config at @savvy-web/silk/changesets/changelog and replace savvy-changesets with savvy changeset.

Since package/README.md is what gets published to npm, users reading the package page will be given incorrect migration instructions. See inline comments on both files.

Stale @rslib/core devDependency (minor)

rslib.config.ts is deleted but @rslib/core: "^0.22.0" remains in devDependencies. If @savvy-web/bundler doesn't peer-require rslib, this entry can be dropped to keep the published manifest clean.

What looks good

• The .changeset/cozy-grapes-yell.md entry is accurate and comprehensive — correct package names, correct bin replacements, clear migration steps.
• savvy.build.ts is a clean replacement for rslib.config.ts; import.meta.main guard is the right pattern for dual use as a module and a runnable script.
• @since syntaxKind change from "modifier" → "block" is applied consistently across both savvy.build.ts and tsdoc.json.
• turbo.json now correctly wires build:meta between build:dev and build:prod, and the expanded inputs globs (*.ts, *.mts, *.cts) will prevent stale cache hits from TypeScript-adjacent config files.
• silk-update-action v2 → v3 bump is a routine maintenance update.

[savvy-web-bot]

Code Review

Current Commit: e68ee1a

Summary

This PR deprecates @savvy-web/changesets and migrates the build system from @savvy-web/rslib-builder to @savvy-web/bundler. The follow-up commit e68ee1a ("chore: correct notices") addressed all three issues flagged in the initial review — all threads have been resolved.

Validation Checks

Check	Status
PR Title Validation	✅ success
Conventional Commits	✅ success
Code Quality	✅ success
Markdown	✅ success
Tests	✅ success

What Changed

• Deprecation notices (README.md, package/README.md): Correctly describe the changelog formatter / remark pipeline migration to @savvy-web/silk, with savvy changeset replacing savvy-changesets. The npm-published package/README.md uses a plain blockquote (no GitHub callout syntax) which is appropriate for npm rendering.
• Build system migration: rslib.config.ts deleted, savvy.build.ts added using @savvy-web/bundler. @rslib/core and @savvy-web/rslib-builder removed from devDependencies; @savvy-web/bundler added in their place. Build scripts updated accordingly.
• Dependency bumps: @savvy-web/silk-effects → 1.0.0, workspaces-effect → 1.2.0, effect → 3.21.3, @savvy-web/silk → 0.4.0 (root workspace).
• publishConfig.targets: Simplified from array-of-objects to { npm: true, github: true } shorthand — consistent with the new bundler's expected shape.
• tsdoc.json: @since tag kind changed from modifier to block; tags sorted alphabetically. Aligns with savvy.build.ts definition.
• Workflow: silk-update-action bumped from v2 to v3.
• Changeset: Accurately documents the breaking change and migration path.

Positive Observations

The changeset (cozy-grapes-yell.md) is well-written — it names the concrete migration steps (replace package, update config path, replace bin) and explicitly states "final release / no further patches," which is exactly the right signal for consumers to act on.

---

PR is already merged.