chore: reconcile dependency updates with workspace constraints

development_docs/development.md

@@ -78,6 +78,33 @@ package's optional `lz4js` runtime peer is declared as an exception because its
 import belongs to the Arrow loader workspace. Stale configuration exceptions
 fail the audit.
 
+## Review dependency updates
+
+Renovate and pnpm both enforce a 14-day release cooldown. Review the actual
+manifest and lockfile changes against the current branch; a bot PR's summary
+may include versions that were superseded or could not be installed. Keep
+updates whose releases and required dependencies satisfy the cooldown, and
+leave newer versions for a later update. Keep compatibility constraints in
+`renovate.json` aligned with the workspace overrides. The Babel parser override
+stays on version 7 while the Vue 3.5 compiler packages require that major.
+
+The hosted Renovate bot skips the workspace's `.pnpmfile.mjs` hook. Its generated
+lockfile can therefore lose `pnpmfileChecksum`, even when dependency resolution
+succeeds. That hook also defines the browser package's published dependency set.
+Regenerate the lockfile locally with the declared pnpm version before merging
+an update that drops the checksum or changes manifests without a lockfile:
+
+```bash
+pnpm install --no-frozen-lockfile
+pnpm install --frozen-lockfile
+make check
+```
+
+Commit `pnpm-lock.yaml` with the accepted manifest changes. When updating pnpm
+itself, both `package.json` and the lockfile's package-manager dependency records
+must name the new version. An install rejected by `minimumReleaseAge` should
+wait for maturity; keep the cooldown and its existing exclusions intact.
+
 ## Change Python producer behavior
 
 Stable public records live in `spec.py`, `planning.py`, `prepared.py`,

pnpm-workspace.yaml

@@ -32,7 +32,7 @@ catalog:
   vue: ^3.5.43
   vitepress-mermaid-renderer: 1.2.2
   mermaid: 12.0.0
-  knip: 6.37.0
+  knip: 6.38.0
   picomatch: 4.0.7
   yaml: 2.9.1
 
@@ -51,6 +51,7 @@ minimumReleaseAgeExclude:
   - vite-plus
 
 overrides:
+  # Vue 3.5 compiler packages require parser 7; revisit with their Babel 8 support.
   "@babel/parser": 7.29.9
   lodash-es: 4.18.1
   nanoid: 3.3.19

renovate.json

@@ -4,6 +4,18 @@
   "minimumReleaseAge": "14 days",
   "internalChecksFilter": "strict",
   "packageRules": [
+    {
+      "description": "Verify pnpm artifacts with the workspace packing hook before merging npm updates.",
+      "matchManagers": ["npm"],
+      "prBodyNotes": [
+        "This workspace uses a pnpm packing hook that hosted Renovate skips. If the lockfile drops `pnpmfileChecksum` or artifact generation fails, follow [the dependency update workflow](https://github.com/marimo-team/marimo-export/blob/main/development_docs/development.md#review-dependency-updates): regenerate with `pnpm install --no-frozen-lockfile`, verify `pnpm install --frozen-lockfile`, and run `make check`. Keep the 14-day release cooldown intact."
+      ]
+    },
+    {
+      "description": "Keep the parser override within the Babel 7 range required by Vue 3.5 compilers.",
+      "matchPackageNames": ["@babel/parser"],
+      "allowedVersions": "<8"
+    },
     {
       "description": "Match the browser provider to Vitest bundled by Vite+ 1.0.",
       "matchPackageNames": ["@vitest/browser-playwright"],