Daily engineering digest — 2026-10-09 → 2026-10-10 (UTC)

Date range

2026-10-09T17:12:57Z → 2026-10-10T17:12:57Z (cron window)

No merges to main in this window. Latest merge remains #23 — fix(deps): close patchable prod audit findings (2026-10-07T07:10:14Z).
Scheduled CI stayed green: nightly verification succeeded 2026-10-09T09:17Z and again 2026-10-10T08:39Z; Playwright report publish workflows completed successfully after each run.
Dependabot unblock in review: #33 — fix(deps): unblock Dependabot security updates on main opened 2026-10-10 (Node 24 alignment for apps/site, electron ^43.5.0, pnpm overrides for brace-expansion / http-cache-semantics, .github/dependabot.yml ignores for packages with no upstream patch). CI (lint, typecheck, unit, Postgres journeys, Web E2E) passed on the opening commit.
Billing hardening queued: #30 — retain checkout references for superseded Xendit sessions opened 2026-10-09 (new billing_checkout_sessions table + migration backfill; fixes webhook 404 when payment completes on an older session). CI green on open. #28 — prevent Plus demotion on duplicate checkout expiry remains open; last CI run shows Lint and Typecheck failures (unit tests, Postgres journeys, and Web E2E still passed).
Auth operator docs: #31 — document auth email, rate limits, and SMTP self-host setup opened 2026-10-09 to catch up docs/architecture.md, docs/self-host.md, and README.md with merged auth work (#12). CI green.

Billing rollout risk on main: Until #28 and/or #30 land, edge cases around duplicate/abandoned Xendit checkouts can still mis-handle Plus entitlement; coordinate merge order if both ship together.
#28 CI blockers: Lint/typecheck failures on the last run (2026-10-08) need a fix or rebase before merge despite passing functional tests.
Residual audit surface: #33 documents remaining high findings for transitive packages with no npm patch (braces, node-forge, sprintf-js) — verify ignore policy matches accepted risk before merge.

Automated daily digest (Sentrabot cron). Evidence: main git log, merged/open PRs, and GitHub Actions runs in the window above.