chore(deps): pin non-core dependencies by version, slow down dependabot

Attempt to deal with dependency churn and conflicts we experience in the repo
while resolving tensions we have in what we ship: As libraries, synapse-core
and synapse-sdk have a floating dependency tree where they are used. We could
choose to have a lockfile here for everything but that would only test _our_
use of these packages, not how they get used upstream. Any breakage, even via
transitive dependencies, don't get noticed. It's through us experiencing
the breakage that we get to deal with it.
Unfortunately we also have some very noisy sub-packages in this repo with a
significant dependency trees of their own which cause most of our transitive
breakage. So in an attempt to slow that problem down, we pin our direct
dependencies in the packages other than synapse-sdk and synapse-core, so it's
only breakage via transitives that we experience outside of dependabot updates.

The alternative is to separate out the core libary packages from the extraneous
stuff, particularly docs, which are the source of most of our grief.

This strategy is already working with biome, which is _very_ break-happy.

Author: rvagg

.github/dependabot.yml

@@ -9,7 +9,9 @@ updates:
     directory: /
     open-pull-requests-limit: 5
     schedule:
-      interval: weekly
+      # twice a month (1st and 15th, 09:00 UTC)
+      interval: cron
+      cronjob: '0 9 1,15 * *'
     cooldown:
       default-days: 7
     ignore:

apps/synapse-playground/package.json

@@ -12,34 +12,34 @@
   "dependencies": {
     "@filoz/synapse-core": "workspace:*",
     "@filoz/synapse-react": "workspace:*",
-    "@nanostores/persistent": "^1.3.0",
-    "@nanostores/react": "^1.0.0",
-    "@radix-ui/react-avatar": "^1.1.10",
-    "@radix-ui/react-dialog": "^1.1.15",
-    "@radix-ui/react-dropdown-menu": "^2.1.16",
-    "@radix-ui/react-label": "^2.1.7",
-    "@radix-ui/react-select": "^2.2.6",
-    "@radix-ui/react-separator": "^1.1.7",
-    "@radix-ui/react-slot": "^1.2.3",
-    "@radix-ui/react-switch": "^1.2.6",
-    "@radix-ui/react-tooltip": "^1.2.8",
-    "@tailwindcss/vite": "^4.2.1",
-    "@tanstack/query-sync-storage-persister": "^5.101.0",
-    "@tanstack/react-query": "^5.101.0",
-    "@tanstack/react-query-persist-client": "^5.101.0",
-    "class-variance-authority": "^0.7.1",
-    "clsx": "^2.1.1",
-    "iso-ledger": "^0.1.7",
-    "lucide-react": "^1.8.0",
-    "nanostores": "^1.1.1",
-    "next-themes": "^0.4.6",
+    "@nanostores/persistent": "1.3.4",
+    "@nanostores/react": "1.1.0",
+    "@radix-ui/react-avatar": "1.2.0",
+    "@radix-ui/react-dialog": "1.1.17",
+    "@radix-ui/react-dropdown-menu": "2.1.18",
+    "@radix-ui/react-label": "2.1.10",
+    "@radix-ui/react-select": "2.3.1",
+    "@radix-ui/react-separator": "1.1.10",
+    "@radix-ui/react-slot": "1.3.0",
+    "@radix-ui/react-switch": "1.3.1",
+    "@radix-ui/react-tooltip": "1.2.10",
+    "@tailwindcss/vite": "4.3.1",
+    "@tanstack/query-sync-storage-persister": "5.101.1",
+    "@tanstack/react-query": "5.101.1",
+    "@tanstack/react-query-persist-client": "5.101.1",
+    "class-variance-authority": "0.7.1",
+    "clsx": "2.1.1",
+    "iso-ledger": "0.1.7",
+    "lucide-react": "1.21.0",
+    "nanostores": "1.3.0",
+    "next-themes": "0.4.6",
     "react": "19.2.7",
     "react-dom": "19.2.7",
-    "react-dropzone": "^15.0.0",
-    "react-hook-form": "^7.77.0",
-    "sonner": "^2.0.7",
-    "tailwind-merge": "^3.3.1",
-    "tailwindcss": "^4.2.1",
+    "react-dropzone": "15.0.0",
+    "react-hook-form": "7.80.0",
+    "sonner": "2.0.7",
+    "tailwind-merge": "3.6.0",
+    "tailwindcss": "4.3.1",
     "viem": "catalog:",
     "wagmi": "catalog:",
     "zod": "catalog:"
@@ -48,11 +48,11 @@
     "@biomejs/biome": "catalog:",
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
-    "@vitejs/plugin-react": "^6.0.1",
-    "tw-animate-css": "^1.4.0",
+    "@vitejs/plugin-react": "6.0.3",
+    "tw-animate-css": "1.4.0",
     "typescript": "catalog:",
-    "vite": "^8.0.16",
+    "vite": "8.1.0",
     "vite-plugin-node-polyfills-vite8": "0.25.4",
-    "wrangler": "^4.98.0"
+    "wrangler": "4.105.0"
   }
 }

docs/package.json

@@ -13,27 +13,27 @@
     "@filoz/synapse-core": "workspace:*",
     "@filoz/synapse-react": "workspace:*",
     "@filoz/synapse-sdk": "workspace:*",
-    "@tanstack/react-query": "~5.101.0",
-    "starlight-auto-sidebar": "^0.4.0",
-    "starlight-changelogs": "^0.5.0",
-    "starlight-links-validator": "^0.25.2",
+    "@tanstack/react-query": "5.101.1",
+    "starlight-auto-sidebar": "0.4.0",
+    "starlight-changelogs": "0.5.0",
+    "starlight-links-validator": "0.25.2",
     "viem": "catalog:",
     "wagmi": "catalog:"
   },
   "devDependencies": {
-    "@astrojs/starlight": "^0.41.3",
-    "@hugomrdias/docs": "^0.2.0",
+    "@astrojs/starlight": "0.41.3",
+    "@hugomrdias/docs": "0.2.0",
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
-    "astro": "^7.0.6",
-    "astro-mermaid": "^2.0.2",
-    "expressive-code-twoslash": "^0.6.1",
-    "mermaid": "^11.12.2",
-    "rehype-external-links": "^3.0.0",
-    "sharp": "^0.35.3",
-    "typedoc": "^0.28.19",
-    "typedoc-plugin-mdn-links": "^5.0.10",
-    "typedoc-plugin-missing-exports": "^4.1.2",
-    "wrangler": "^4.98.0"
+    "astro": "7.0.7",
+    "astro-mermaid": "2.1.0",
+    "expressive-code-twoslash": "0.6.1",
+    "mermaid": "11.16.0",
+    "rehype-external-links": "3.0.0",
+    "sharp": "0.35.3",
+    "typedoc": "0.28.19",
+    "typedoc-plugin-mdn-links": "5.1.1",
+    "typedoc-plugin-missing-exports": "4.1.3",
+    "wrangler": "4.105.0"
   }
 }

docs/src/content/docs/core-concepts/storage-providers.mdx

@@ -26,6 +26,7 @@ A non-approved provider is registered in the [ServiceProviderRegistry](/core-con
 - Can still be used explicitly if you pass their `providerId` to lower-level APIs, though this bypasses the quality vetting that approval represents.
 
 It is possible for a provider to be removed from the approved list. Removal does not deactivate existing storage deals and does not prevent further interaction with that provider via the SDK but removal may be an indication of a lowering of service quality.
+
 ## Approved Providers
 
 An approved provider is a member of the **on-chain FWSS approved-provider set**. Approval means the provider has demonstrated, through continuous automated testing, that it meets the published acceptance criteria for storage success, data retention, and retrieval success.

examples/cli/package.json

@@ -13,13 +13,13 @@
   "author": "Hugo Dias <hugomrdias@gmail.com> (hugodias.me)",
   "license": "Apache-2.0 OR MIT",
   "dependencies": {
-    "@clack/prompts": "^1.5.1",
+    "@clack/prompts": "1.6.0",
     "@filoz/synapse-core": "workspace:^",
     "@filoz/synapse-sdk": "workspace:^",
-    "@remix-run/fs": "^0.4.5",
-    "cleye": "^2.3.0",
-    "conf": "^15.0.2",
-    "terminal-link": "^5.0.0",
+    "@remix-run/fs": "0.4.5",
+    "cleye": "2.6.0",
+    "conf": "15.1.0",
+    "terminal-link": "5.0.0",
     "viem": "catalog:"
   },
   "devDependencies": {

examples/script-tag/package.json

@@ -10,6 +10,6 @@
   "author": "Hugo Dias <hugomrdias@gmail.com> (hugodias.me)",
   "license": "Apache-2.0 OR MIT",
   "dependencies": {
-    "servor": "^4.0.2"
+    "servor": "4.0.2"
   }
 }

package.json

@@ -24,10 +24,10 @@
   },
   "devDependencies": {
     "@biomejs/biome": "catalog:",
-    "knip": "^6.15.0",
-    "markdownlint-cli2": "^0.23.0",
+    "knip": "6.21.0",
+    "markdownlint-cli2": "0.23.0",
     "typescript": "catalog:",
-    "wireit": "^0.14.12"
+    "wireit": "0.14.13"
   },
   "simple-git-hooks": {
     "pre-commit": "pnpm exec biome check --staged --fix"

pnpm-workspace.yaml

@@ -40,30 +40,13 @@ minimumReleaseAgeExclude:
   - iso-base
   - '@hugomrdias/docs'
   - playwright-test
-  # viem 2.52.0 bump (#810) landed inside cooldown; viem pins ox exactly.
-  # Remove after 2026-06-08 when both age out.
-  - viem@2.52.0
-  - ox@0.14.27
-  # astro 6.4.2 fixes MDX/Starlight compatibility after 6.4.0.
-  # Remove after 2026-06-05 when it ages out.
-  - astro@6.4.2
 
 trustPolicy: no-downgrade
 
 trustPolicyExclude:
   # 0.2.0 published manually without provenance (0.1.9 was trusted-published).
   # Remove when republished via trusted CI.
   - '@hugomrdias/docs@0.2.0'
-  # 2.0.x published manually; 2.0.2 (2026-06-01) is trusted-published.
-  # Remove after 2026-06-08 when 2.0.2 ages past cooldown.
-  - 'astro-mermaid@2.0.1'
-  # tinylibs staged-publishing false positive (npm metadata omitted trusted-publisher
-  # signal, see tinylibs/tinyclip#37); 1.2.4 (2026-05-31) is trusted-published.
-  # Remove after 2026-06-07.
-  - 'tinyexec@1.2.2'
-  # Same staged-publishing false positive; tarball diffed clean vs 0.1.12.
-  # 0.1.14 (2026-06-03) is trusted-published. Remove after 2026-06-10.
-  - 'tinyclip@0.1.13'
   # Last 4.x (Dec 2024) predates chokidar adopting trusted publishing at 5.0.0.
   # Permanent while anything depends on chokidar@^4.
   - chokidar@4.0.3