🔒 Cover coordinated dependency axes

.github/dependabot.yml

@@ -43,18 +43,51 @@ updates:
           - 'version-update:semver-major'
           - 'version-update:semver-minor'
           - 'version-update:semver-patch'
+      - dependency-name: 'vite'
+        update-types:
+          - 'version-update:semver-major'
+          - 'version-update:semver-minor'
+          - 'version-update:semver-patch'
+      - dependency-name: '@playwright/test'
+        update-types:
+          - 'version-update:semver-major'
+          - 'version-update:semver-minor'
+          - 'version-update:semver-patch'
       - dependency-name: '@types/node'
         update-types:
           - 'version-update:semver-major'
     commit-message:
       prefix: '⬆️'
 
+  # This independent install fixture has its own lockfile. Routine changes must
+  # stay synchronized with root/test-axis versions, but security updates remain
+  # eligible because update-types applies only to version updates.
+  - package-ecosystem: 'npm'
+    directory: '/test/fixtures/packed-consumer'
+    versioning-strategy: increase
+    schedule:
+      interval: 'monthly'
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - 'version-update:semver-major'
+          - 'version-update:semver-minor'
+          - 'version-update:semver-patch'
+    commit-message:
+      prefix: '⬆️'
+
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
       interval: 'monthly'
     cooldown:
       default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
     groups:
       github-actions:
         applies-to: version-updates

.github/workflows/security.yml

@@ -52,5 +52,5 @@ jobs:
           corepack install
           npm --version
 
-      - name: Audit locked dependencies
+      - name: Audit root and packed-consumer dependencies
         run: npm run security:audit

CONTRIBUTING.md

@@ -41,6 +41,13 @@ replacing the React 18 or TypeScript 5.5 minimum-version fixtures, and regenerat
 both lockfiles together. Keep root `@types/node` on the Node 22 support floor;
 routine updates within that major remain automated.
 
+Vite must match between the root and packed-consumer fixture. Playwright Test
+must match the digest-pinned container and its browser binaries. Update either
+set manually and review any affected browser snapshots. The packed-consumer
+lockfile has separate Dependabot security coverage and is included in
+`npm run security:audit`, but its routine updates remain part of this coordinated
+process.
+
 ## Checks
 
 Run the checks relevant to your change. Before requesting review, the complete

docs/RELEASING.md

@@ -20,6 +20,9 @@ another release.
   passes.
 - The release workflow must use the repository's verified Corepack bootstrap
   and integrity-pinned npm version.
+- Trusted publishing must use OIDC without `NODE_AUTH_TOKEN`. Bootstrap or
+  emergency token publishing must set `NODE_AUTH_TOKEN` explicitly only on the
+  publish step; `actions/setup-node` v7 no longer supplies a dummy value.
 - Workflow actions must use full commit SHAs and least-privilege permissions.
 - Only the publishing job may receive `id-token: write`; release operations may
   receive `contents: write` only when required.

package.json

@@ -28,7 +28,9 @@
     "watch": "tsdown --watch",
     "build": "tsdown",
     "package:check": "npm run build && node scripts/check-package.mjs",
-    "security:audit": "npm audit --audit-level=high",
+    "security:audit": "npm run security:audit:root && npm run security:audit:consumer",
+    "security:audit:root": "npm audit --audit-level=high",
+    "security:audit:consumer": "npm audit --prefix test/fixtures/packed-consumer --audit-level=high",
     "format": "prettier . --write",
     "format:check": "prettier . --check",
     "lint": "eslint . --max-warnings 0",