chore: update dependency safeguards

Update package manager metadata, dependency overrides, landing and MCP package versions, Dependabot configuration, and CI audit/store handling for safer dependency maintenance.

.github/dependabot.yml

@@ -0,0 +1,39 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directories:
+      - /
+      - /landing
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Etc/UTC
+    cooldown:
+      default-days: 3
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: chore
+      prefix-development: chore
+      include: scope
+    groups:
+      npm-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    cooldown:
+      default-days: 3
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: chore
+      include: scope

.github/workflows/ci.yml

@@ -14,6 +14,7 @@ on:
       - 'runtime.lock.json'
       - 'test/**'
       - '.github/workflows/**'
+      - '.github/dependabot.yml'
       - 'pnpm-workspace.yaml'
       - 'package.json'
       - 'pnpm-lock.yaml'
@@ -34,6 +35,7 @@ on:
       - 'runtime.lock.json'
       - 'test/**'
       - '.github/workflows/**'
+      - '.github/dependabot.yml'
       - 'pnpm-workspace.yaml'
       - 'package.json'
       - 'pnpm-lock.yaml'
@@ -66,11 +68,16 @@ jobs:
           cache: pnpm
 
       - name: Restore pnpm node-gyp executable bit
-        run: find "$(dirname "$(command -v pnpm)")/store" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
+        run: |
+          PNPM_STORE="$(pnpm store path)"
+          find "$PNPM_STORE" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Audit dependencies
+        run: pnpm audit --audit-level high
+
       - name: Restore ESLint cache
         uses: actions/cache@v5
         with:
@@ -99,7 +106,9 @@ jobs:
           cache: pnpm
 
       - name: Restore pnpm node-gyp executable bit
-        run: find "$(dirname "$(command -v pnpm)")/store" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
+        run: |
+          PNPM_STORE="$(pnpm store path)"
+          find "$PNPM_STORE" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/landing.yml

@@ -31,6 +31,10 @@ jobs:
         working-directory: landing
         run: npm ci
 
+      - name: Audit dependencies
+        working-directory: landing
+        run: npm audit --audit-level high
+
       - name: Generate static site
         working-directory: landing
         env:

.github/workflows/release.yml

@@ -46,7 +46,9 @@ jobs:
           cache: pnpm
 
       - name: Restore pnpm node-gyp executable bit
-        run: find "$(dirname "$(command -v pnpm)")/store" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
+        run: |
+          PNPM_STORE="$(pnpm store path)"
+          find "$PNPM_STORE" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -340,7 +342,9 @@ jobs:
           python-version: '3.11'
 
       - name: Restore pnpm node-gyp executable bit
-        run: find "$(dirname "$(command -v pnpm)")/store" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
+        run: |
+          PNPM_STORE="$(pnpm store path)"
+          find "$PNPM_STORE" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -459,7 +463,9 @@ jobs:
           python-version: '3.11'
 
       - name: Restore pnpm node-gyp executable bit
-        run: find "$(dirname "$(command -v pnpm)")/store" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
+        run: |
+          PNPM_STORE="$(pnpm store path)"
+          find "$PNPM_STORE" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -583,7 +589,9 @@ jobs:
           sudo apt-get install -y libarchive-tools rpm xvfb
 
       - name: Restore pnpm node-gyp executable bit
-        run: find "$(dirname "$(command -v pnpm)")/store" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
+        run: |
+          PNPM_STORE="$(pnpm store path)"
+          find "$PNPM_STORE" -path '*/node-gyp/gyp/gyp_main.py' -exec chmod +x {} \; 2>/dev/null || true
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

landing/package.json

@@ -24,7 +24,7 @@
     "@nuxtjs/i18n": "^9.5.6",
     "@pinia/nuxt": "^0.11.3",
     "@vueuse/nuxt": "^10.11.1",
-    "nuxt": "^3.20.2",
+    "nuxt": "^3.21.6",
     "nuxt-icon": "^0.6.10",
     "pinia": "^3.0.4",
     "swiper": "^12.1.2",
@@ -38,7 +38,7 @@
     "@nuxt/eslint": "^1.12.1",
     "@shikijs/transformers": "3.22.0",
     "autoprefixer": "^10.5.0",
-    "eslint": "^9.39.2",
+    "eslint": "^9.39.4",
     "medium-zoom": "^1.1.0",
     "prettier": "^3.8.0",
     "sass": "^1.97.2",

mcp-server/package.json

@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "agent-teams-controller": "workspace:*",
-    "fastmcp": "^3.34.0",
+    "fastmcp": "^3.35.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {

package.json

@@ -198,7 +198,7 @@
     "zustand": "^4.5.0"
   },
   "devDependencies": {
-    "@electron/rebuild": "^4.0.3",
+    "@electron/rebuild": "^4.0.4",
     "@eslint-community/eslint-plugin-eslint-comments": "^4.6.0",
     "@eslint/js": "^9.39.2",
     "@sentry/vite-plugin": "^5.1.1",
@@ -216,7 +216,7 @@
     "electron": "^40.10.0",
     "electron-builder": "^26.8.1",
     "electron-vite": "^5.0.0",
-    "eslint": "^9.39.2",
+    "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-boundaries": "^5.3.1",
@@ -230,18 +230,18 @@
     "eslint-plugin-sonarjs": "^3.0.6",
     "eslint-plugin-tailwindcss": "^3.18.2",
     "globals": "^17.2.0",
-    "happy-dom": "^20.0.2",
+    "happy-dom": "^20.9.0",
     "husky": "^9.1.7",
     "knip": "^5.82.1",
     "lint-staged": "^16.2.7",
-    "postcss": "^8.4.35",
+    "postcss": "^8.5.10",
     "prettier": "^3.8.1",
     "prettier-plugin-tailwindcss": "^0.7.2",
     "tailwindcss": "^3.4.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.54.0",
-    "vite": "^5.4.2",
+    "vite": "^6.4.2",
     "vitest": "^3.1.4"
   },
   "build": {
@@ -364,8 +364,47 @@
   "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
   "pnpm": {
     "overrides": {
+      "@hono/node-server@1": "1.19.13",
+      "@xmldom/xmldom": "0.8.13",
+      "axios": "1.15.2",
+      "brace-expansion@1": "1.1.13",
+      "brace-expansion@2": "2.0.3",
+      "brace-expansion@5": "5.0.6",
+      "defu": "6.1.5",
+      "devalue": "5.8.1",
+      "fast-uri": "3.1.2",
+      "file-type@21": "21.3.2",
+      "flatted": "3.4.2",
+      "follow-redirects": "1.16.0",
+      "handlebars": "4.7.9",
+      "hono": "4.12.18",
+      "ip-address": "10.1.1",
+      "lodash": "^4.18.1",
       "lodash-es": "^4.18.1",
-      "uuid": "^11.1.1"
+      "@nuxt/devtools-kit>vite": "7.3.2",
+      "minimatch@3": "3.1.4",
+      "minimatch@5": "5.1.8",
+      "minimatch@9": "9.0.7",
+      "minimatch@10": "10.2.3",
+      "nitropack": "2.13.4",
+      "node-forge": "1.4.0",
+      "path-to-regexp": "8.4.0",
+      "picomatch@2": "2.3.2",
+      "picomatch@4": "4.0.4",
+      "postcss": "8.5.10",
+      "qs": "6.15.2",
+      "rollup": "4.59.0",
+      "serialize-javascript": "7.0.5",
+      "simple-git": "3.36.0",
+      "smol-toml": "1.6.1",
+      "srvx": "0.11.13",
+      "tar": "7.5.11",
+      "undici@7": "7.24.0",
+      "unhead": "2.1.13",
+      "uuid": "^11.1.1",
+      "vitepress>vite": "7.3.2",
+      "ws": "8.20.1",
+      "yaml": "2.9.0"
     },
     "onlyBuiltDependencies": [
       "electron",

pnpm-workspace.yaml

@@ -3,5 +3,10 @@ packages:
   - mcp-server
   - landing
   - packages/agent-graph
+minimumReleaseAge: 4320
+strictPeerDependencies: true
+peerDependencyRules:
+  allowedVersions:
+    "@nuxt/schema": "3.21.6"
 ignoredBuiltDependencies:
   - esbuild