[savvy-web-bot]

Promote dependency updates

Automated promotion of dependency updates accumulated on dev into main.
Triggered by merged dependency PR #514.

This PR is left open so cloud reviewers and the action's smoke tests can
run against the changes before release. Merging it starts the normal
release cycle.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​okfit/​plugin@​0.5.20 ⏵ 0.5.21				+1
	@​savvy-web/​silk@​4.3.12 ⏵ 4.3.13
	@​vitest-agent/​plugin@​5.4.6 ⏵ 5.4.7	+1		+1	+1
	@​effected/​pnpm-plugin-effect@​0.17.1 ⏵ 0.17.2				+1
	@​effected/​github-actions@​0.23.0 ⏵ 0.23.1				+1

View full report

[savvy-web-bot]

Code Review

Current Commit: 16631d10e9ddb3508ffcb6371a161dd13590cfb5

Summary

Automated dependency promotion from dev → main. Outside the generated dist/, .github/actions/local/, and pnpm-lock.yaml churn (all out of scope), the substantive diff is three files:

File	Change
package.json	@okfit/plugin ^0.5.20→^0.5.21, @savvy-web/silk ^4.3.12→^4.3.13, @vitest-agent/plugin ^5.4.6→^5.4.7 (devDependencies); devEngines.runtime Node 26.12.0→26.12.1
pnpm-workspace.yaml	config dependency @effected/pnpm-plugin-effect 0.17.1→0.17.2
.changeset/…-deps.md	patch changeset recording the runtime @effected/github-actions ^0.23.0→^0.23.1 bump

Observations

• Changeset scope is correct. The changeset records only @effected/github-actions — the sole non-dev runtime dependency whose bump reaches consumers of the published action. The three devDependencies, the config dependency, and the dev-only devEngines.runtime Node bump are internal to development and correctly left out of the consumer-facing changelog.
• minimumReleaseAgeExclude stays consistent. @effected/pnpm-plugin-effect remains the listed exclusion, which is what permits its 0.17.1→0.17.2 config-dependency bump here.
• All five validation checks pass at this commit (Tests — 619 passed, Code Quality, Markdown, Conventional Commits, PR Title Validation). The committed dist/ / .github/actions/local/ artifacts are covered by those passing build and test runs.
• Socket supply-chain scan reports no vulnerabilities (score 100) across all five updated packages; no new issues flagged.

No correctness, safety, or style concerns. All changes are patch-level version bumps with no source-logic impact.

Approval

Not submitting a formal approval: this PR was opened by the review bot (savvy-web-bot[bot]), and GitHub rejects self-approval. The change is clean and ready — maintainers can merge to start the release cycle.

Note: the sticky-comment update tool returned Not Found (no pre-existing sticky comment on first review), so this review was posted as a new comment instead.

Signed-off-by: C. Spencer Beggs spencer@savvyweb.systems