[dependabot]

This consolidates ten dependency updates into one validated merge so shared workflow and lockfile edits land together. Original PR commits are preserved; merge this PR with a merge commit to retain their ancestry.

Includes #240 (release action), #241 (setup-python), #242 (pnpm setup), #243 (checkout), #244 (artifact uploads), #245 (Ruff), #247 (Changesets changelog), #249 (Changesets CLI), #250 (tsx), and the original #251 (jose).

Resolves adjacent checkout/pnpm workflow edits and regenerates the root lockfile with pnpm 10.30.3 while retaining the patched just-bash dependency. Adds a patch changeset for jose validation fixes. Package versions and CHANGELOG.md are unchanged.

The Node 26 types (#246), SDK Vitest 5 (#248), and Biome 2 (#252) updates are excluded. #246 conflicts with the Node 22 target and omits its lockfile; #248 omits its lockfile; #252 fails lint because its Biome configuration was not migrated.

Validation passed on a fresh GitHub-hosted runner: pnpm check, pnpm security:audit, and pnpm verify:architecture ran sequentially, with no assertions or timeouts changed. Full proof and downloadable verification evidence. The temporary validation branch (#254) differs from this PR only by its additional workflow; that workflow is excluded from this merge.

The expanded profile includes the standard disposable PostgreSQL/Redis, HTTP/MCP contracts, integration suite, live TypeScript/Python SDKs, worker failures, stream finalization, input budgets, and tenant proofs. The normal PR CI is also green. A separate Changesets 3 release fixture passed patch versioning, custom changelog generation with GitHub PR attribution/hash stripping, and changeset consumption. Actions upgrades were checked against upstream release notes and exercised on GitHub-hosted ubuntu-latest runners.

Local pnpm check and pnpm verify:local attempts reported timing-sensitive admission/event-loop and worker startup/latency failures on the busy shared host. The affected unit files passed five consecutive focused runs on both the baseline and updated branches. The fresh runner passed the full unchanged suites; the cause of the local failures has not been conclusively established.

The security audit passes the repository high-severity gate, with one existing moderate advisory in sprintf-js through the unchanged just-bash dependency. No dependency, patch, or security gate was removed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5def4731-fd83-445f-b329-6c7d6da8a822

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Hazzng]

Reviewed the combined dependency/workflow diffs and conflict resolutions. Full sequential pnpm check, security audit, and expanded architecture/runtime verification passed on the isolated runner: https://github.com/Hazzng/sql-fs/actions/runs/38493125490. The validation branch differs only by the temporary workflow, which is excluded here. Changesets release generation also passed its fixture. The three incompatible upgrades are excluded. Merge with a merge commit to preserve all ten original PR heads.