Daily engineering digest — 2026-10-10 → 2026-10-11 (UTC) #37

Date range

2026-10-10T17:00:00Z → 2026-10-11T17:00:42Z (cron window)

Key changes

• #35 — fix(deps): close remaining patchable audit findings merged 2026-10-11T09:34:32Z (sole main commit in window: 82b9486). Reinforces dependency floors (proxy-addr, shell-quote, mysql2, sharp, @modelcontextprotocol/sdk), bumps undici overrides, patches Electron → 43.7.9 (GHSA-qmv3-fv6v-rmhq), and adds brace-expansion / http-cache-semantics overrides. Aligns apps/site Node engines with the monorepo.
• Dependabot policy on main: new .github/dependabot.yml ignores braces, node-forge, and sprintf-js (no upstream npm patch; tracked via audit / manual review).
• Post-merge CI green: push workflow after merge (Actions run) passed lint, typecheck, unit tests, Postgres journeys, production builds, app/updater images, and Web E2E. PR author verification cited 2122 unit tests and pnpm check 20/20.
• Scheduled verification: nightly verification succeeded 2026-10-11T09:03Z (within window).
• Large dependency wave queued (not merged): #36 — chore(deps): bump the npm_and_yarn group with 80 updates opened/updated 2026-10-11; includes major bumps (e.g. TypeScript 7, Vitest 5, Vite 8, Lingui 6, RN gesture-handler 3, Electron 44). Treat as separate from the targeted security merge on fix(deps): close remaining patchable audit findings #35.
• Billing / auth still open: #30 (Xendit checkout session retention + migration) and #31 (auth email / SMTP docs) unchanged on main. #33 (Dependabot unblock) remains open with green CI but overlaps thematically with merged fix(deps): close remaining patchable audit findings #35.

Watchlist

1. #36 merge risk: 80-package group bump with many semver-major toolchain and mobile/desktop deps — needs deliberate review and full CI before merge; easy regression vector for Electron, Expo, and build tooling.
2. Residual audit (accepted for now): per fix(deps): close remaining patchable audit findings #35, pnpm audit --prod still reports 2 high (braces, node-forge) and 1 moderate (sprintf-js) with no npm fix; confirm ignore list matches accepted risk.
3. #28 CI blockers: billing fix for Plus demotion on duplicate checkout expiry still shows Lint and Typecheck failures on latest checks (functional tests passed); must clear before merge alongside #30.

Automated daily digest (Sentrabot cron). Evidence: main git log, merged/open PRs, and GitHub Actions runs in the window above.