[joe-bell]

Requested by Joe · project thread

Description

Supersedes #469 and #471, and stops the next Dependabot npm PR from failing the same way.

Why they failed

• ci: bump vite from 8.1.0 to 8.1.6 #469 (vite 8.1.0 → 8.1.6) bumped all 15 manifests and the lockfile but left the root "vite": "^8.1.0" override in pnpm-workspace.yaml, so syncpack lint failed (DiffersToHighestOrLowestSemver).
• ci: bump astro from 7.3.1 to 7.3.3 in /docs #471 (astro 7.3.1 → 7.3.3 "in /docs") changed only docs/package.json. The lockfile was left stale, so every pnpm install --frozen-lockfile failed (ERR_PNPM_OUTDATED_LOCKFILE), and that took down every CI job and the Workers build. It also skipped the two Astro examples that pin the same version. Dependabot's npm support stops at pnpm 10 and this workspace pins pnpm 11 (already noted in REVIEW.md), so these security updates can't be trusted to finish the job.

Changes

• Applies both updates across the workspace: vite ^8.1.6 everywhere, astro 7.3.3 in docs and both Astro examples, and a regenerated lockfile. The lockfile now resolves a single vite@8.3.5, which also clears the 8.2.2 copy on main that pnpm audit flags under the same advisories. After this, pnpm audit reports no vite or astro advisories.
• Removes the root vite override. Removing it leaves every resolved version the same, but nothing that bumps vite (Dependabot or syncpack fix) edits pnpm-workspace.yaml, so every vite bump would fail syncpack. AGENTS.md now says not to override packages that a workspace manifest depends on directly.
• Adds .github/workflows/dependabot.yml (dependabot / sync). It runs on Dependabot's pushes to its own dependabot/npm_and_yarn/* branches. It runs syncpack fix (the base branch's pinned version) and then a lockfile-only pnpm install, and pushes one chore(deps): sync … commit when anything changed. On the ci: bump astro from 7.3.1 to 7.3.3 in /docs #471 state this produces exactly the fix in this PR (verified locally: syncpack bumps both examples, and the regenerated lockfile passes --frozen-lockfile).

Additional context

• Security boundary. This is the only pull_request job that can write to the repo (contents: write), so please review it as a privileged job. It runs no dependency or PR code. syncpack is installed outside the checkout from the public registry with --ignore-scripts, and pnpm runs with --lockfile-only --ignore-scripts --ignore-pnpmfile. The checkout keeps no credentials, and GITHUB_TOKEN reaches only the push step. Its own push (actor github-actions[bot]), maintainer pushes and forks all skip the job, so it can't loop. REVIEW.md lists these guards.
• Approve once per repaired PR. The push uses GITHUB_TOKEN, so the repaired PR's pull_request runs wait at action_required (same behaviour weekly.yml documents) until you approve them. A Dependabot secret holding a PAT would avoid that, but it would put an owner credential in Dependabot runs, so I left it out.
• If a fix is younger than minimumReleaseAge (3 days), the lockfile step fails. Re-run it once the release is old enough.
• After merge, Dependabot should close ci: bump vite from 8.1.0 to 8.1.6 #469 and ci: bump astro from 7.3.1 to 7.3.3 in /docs #471 on its own. If it doesn't, close them by hand.
• No packages/cva changes, so the beta What's New page is unaffected.
• Verified locally: syncpack:lint, check, test (100% coverage), build:examples, pnpm --filter docs build, bundlesize (sizes unchanged).
• Other advisories still reported on main and not touched here: undici (the existing override needs ^7.30.1), zod, @vitest/mocker, @vue/server-renderer, fast-uri, minimatch, postcss-selector-parser, deepmerge.

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Before submitting the PR, please make sure you do the following

• Read the Contributing Guidelines.
• Follow the Style Guide.
• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
• Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@​8.2.2 ⏵ 8.3.5	+1	+22	+1
	astro@​7.3.1 ⏵ 7.3.3	+1	+3	+1

View full report

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	cva	23a9f4a	Commit Preview URL Branch Preview URL	Nov 02 2026, 01:25 PM