[fctl-sh]

Summary

Dependabot's security update #252 failed three checks because of how GitHub runs security updates in an npm workspace. GitHub raises a vulnerable package's alert once for each manifest that holds it (for happy-dom, the root package-lock.json and web/package.json, which pins it) and opens a pull request for each, sometimes days apart. Dependabot looks for package-lock.json only in the directory it updates (its npm file fetcher reads parent directories for pnpm's lockfile, not npm's), so the pull request from /web changed web/package.json without the lockfile, and npm ci refused it in the web job and the smoke test. With no configuration, its title, "Bump happy-dom from 21.0.3 to 21.0.4 in /web", failed Conventional Commits too.

.github/dependabot.yml now titles security updates build(deps): bump … (ci(deps): bump … for the workflows' actions) and keeps version updates off, as they are today (open-pull-requests-limit: 0). It has the workspaces' and the crates' own directories (/web, /deploy/standalone, /crates/*, /xtask) open no pull requests: the root's pull request for the same alert changes their manifests and the lockfile together, as it did in another public npm workspace laid out like this one, which got both pull requests for one advisory. docs/development.md says so under Checks, along with the one case that still fails the title check: a package name and versions long enough to take a title past 72 characters (26 of the 541 locked packages, nearly all platform builds such as @cloudflare/workerd-linux-64), which someone shortens by hand. I validated the file against SchemaStore's Dependabot schema and ran the titles it produces through cargo xtask lint-commit. What GitHub does with it only shows once it is on main, at the next alert.

#252 itself can merge now: I added the root lockfile's change to its branch (npm 10, as CI runs it: happy-dom's version, tarball and integrity alone) and retitled it build(deps): bump happy-dom from 21.0.3 to 21.0.4, and its checks pass. Dependabot's other alert today, undici, can't be fixed yet: wrangler 4.151.1, and 4.152.0 as well, pins a miniflare that pins undici 7.29.1, and the fix is 7.30.1. Why fctl's review agent skipped #252, and a change that has it review Dependabot's pull requests, are in #255:

• build(deps): bump happy-dom from 21.0.3 to 21.0.4 #252
• feat(control): review Dependabot's pull requests without being asked #255

The same titles for the other repositories that check them (hyperstructure/sandbox's Dependabot already uses ci(deps)):

• ci: give Dependabot's security updates Conventional Commit titles design#18
• ci: give Dependabot's security updates Conventional Commit titles fctl-site#54

Worth confirming

• Decision: Version updates stay off; Dependabot opens security updates only, as the repository's settings had it. Raising open-pull-requests-limit turns them on for an ecosystem.
• Assumption: Whenever GitHub raises an alert on a workspace's package.json or a crate's Cargo.toml, it raises the same one on the root lockfile, whose pull request fixes both. If it ever doesn't, that alert gets no pull request, since those directories open none.

fctl session