Stop Dependabot proposing npm updates it cannot lock

[DeDuva]

Fixes the root cause behind three of the stale Dependabot PRs, and lands the two upgrades they were trying to make.

The bug

.github/dependabot.yml declared /packages/squad-cli and /packages/squad-sdk as their own package-ecosystem: npm entries. Both are members of workspaces: packages/* and neither has a package-lock.json of its own:

directory	package.json	package-lock.json
/	yes	yes
/docs	yes	yes
/packages/squad-cli	yes	no
/packages/squad-sdk	yes	no

A directory-scoped entry therefore makes Dependabot edit that member's manifest and nothing else. The manifest and the single root lockfile then disagree, and npm ci refuses:

npm error `npm ci` can only install packages when your package.json and
npm error package-lock.json ... are in sync.
npm error Missing: esbuild@0.28.2 from lock file

Every check that installs before it does anything fails, for a reason unrelated to the dependency being bumped. #111, #112 and #26 were all in this state, and all three reported mergeable: MERGEABLE throughout — GitHub has no opinion about whether a lockfile installs.

The / entry already updates every member manifest together with the root lockfile — that is what #130 did — so the two entries are removed rather than repaired.

The upgrades

Landed here with a correct lockfile, superseding the PRs that could not carry one:

• esbuild ^0.25.0 → ^0.28.2 in squad-cli — supersedes deps: bump esbuild from 0.25.12 to 0.28.2 in /packages/squad-cli in the minor-patch group across 1 directory #112
• @opentelemetry/{exporter-metrics-otlp-grpc,exporter-trace-otlp-grpc,sdk-node} ^0.219.0 → ^0.221.0 in squad-sdk — supersedes deps: bump the minor-patch group across 1 directory with 3 updates #111

#26 (typescript in squad-sdk) is also obsoleted by the config change, but its content is not landed here — see below.

On the lockfile diff size

~6,500 lines, which deserves an explanation rather than a shrug. The churn is concentrated in exactly the two trees being upgraded — 60 @opentelemetry and 26 @esbuild entries move — and a control run of npm install --package-lock-only against unmodified dev changes 4 lines, so this is the upgrade rather than a reformat by a different npm.

The two unrelated normalisations npm applied to squad-sdk/package.json (unescaping —, dropping an empty dependencies: {}) have been reverted, so that manifest's diff is three version lines and nothing else.

Validation

Local, on this branch:

• npm ci → exit 0, and leaves every tracked dependency file unmodified
• npm run build → exit 0
• npm run check (check:docs + lint + test) → exit 0, 289 files / 7549 tests passed

One note for anyone running the suite locally: test/lab-grader.test.ts asserts the grader child process sees no *TOKEN* environment variables, so it fails under any shell that has one set — running inside Claude Code, for instance. CI has none, and it passes there. Unrelated to this change, but it will waste someone's afternoon eventually.

What this does not fix

typescript 6 → 7 (#33, #26) stays open. typescript-eslint peer-requires typescript >=4.8.4 <6.1.0 at its newest release (8.69.0), so TS 7 has no supported version of the lint toolchain to move to.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit e0bac57

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
✅	Single commit	1 commit — clean history
✅	Not in draft	Ready for review
❌	Branch up to date	dev is 2 commit(s) ahead — rebase recommended
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (4 files, +6501 −6055)

File	+/−
.github/dependabot.yml	+9 −38
package-lock.json	+6485 −6010
packages/squad-cli/package.json	+2 −2
packages/squad-sdk/package.json	+5 −5

Total: +6501 −6055

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🔒 Security Review

🔒 Security review: 2 info.

Severity	Category	Finding	Location
ℹ️ info	new-dependency	2 new/changed dependency version(s) in packages/squad-cli/package.json. Verify these packages are trusted and necessary.	packages/squad-cli/package.json:3
ℹ️ info	new-dependency	4 new/changed dependency version(s) in packages/squad-sdk/package.json. Verify these packages are trusted and necessary.	packages/squad-sdk/package.json:3

---

Automated security review — informational only.

[github-actions]

🟡 Impact Analysis — PR #135

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	4
Files added	0
Files modified	4
Files deleted	0
Modules touched	4
Critical files	2

🎯 Risk Factors

• 4 files changed (≤5 → LOW)
• 4 modules touched (2-4 → MEDIUM)
• Critical files touched: packages/squad-cli/package.json, packages/squad-sdk/package.json

📦 Modules Affected

ci-workflows (1 file)

• .github/dependabot.yml

root (1 file)

• package-lock.json

squad-cli (1 file)

• packages/squad-cli/package.json

squad-sdk (1 file)

• packages/squad-sdk/package.json

⚠️ Critical Files

• packages/squad-cli/package.json
• packages/squad-sdk/package.json

---

This report is generated automatically for every PR. See #733 for details.