From 4671545893f8e517c6363d1faa7b116df98ef8d5 Mon Sep 17 00:00:00 2001
From: Isaac Insoll <isaac@thebos.com.au>
Date: Mon, 3 Aug 2026 14:48:08 +1000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20refine=20coordinated=20dependenc?=
 =?UTF-8?q?y=20policy?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove the redundant packed-consumer Dependabot entry, coordinate Vitest with Vite, and document the visual-baseline reason for manual toolchain updates. The independent lockfile remains covered by the explicit scheduled audit.
---
 .github/dependabot.yml | 26 +++++---------------------
 CONTRIBUTING.md        | 17 +++++++++++------
 2 files changed, 16 insertions(+), 27 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b2e4f31..37bab8c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -48,35 +48,19 @@ updates:
           - 'version-update:semver-major'
           - 'version-update:semver-minor'
           - 'version-update:semver-patch'
-      - dependency-name: '@playwright/test'
+      - dependency-name: 'vitest'
         update-types:
           - 'version-update:semver-major'
           - 'version-update:semver-minor'
           - 'version-update:semver-patch'
-      - dependency-name: '@types/node'
-        update-types:
-          - 'version-update:semver-major'
-    commit-message:
-      prefix: '⬆️'
-
-  # This independent install fixture has its own lockfile. Routine changes must
-  # stay synchronized with root/test-axis versions, but security updates remain
-  # eligible because update-types applies only to version updates.
-  - package-ecosystem: 'npm'
-    directory: '/test/fixtures/packed-consumer'
-    versioning-strategy: increase
-    schedule:
-      interval: 'monthly'
-    cooldown:
-      default-days: 7
-      semver-major-days: 30
-      semver-minor-days: 7
-    ignore:
-      - dependency-name: '*'
+      - dependency-name: '@playwright/test'
         update-types:
           - 'version-update:semver-major'
           - 'version-update:semver-minor'
           - 'version-update:semver-patch'
+      - dependency-name: '@types/node'
+        update-types:
+          - 'version-update:semver-major'
     commit-message:
       prefix: '⬆️'
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2b2429f..2559432 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -41,12 +41,17 @@ replacing the React 18 or TypeScript 5.5 minimum-version fixtures, and regenerat
 both lockfiles together. Keep root `@types/node` on the Node 22 support floor;
 routine updates within that major remain automated.
 
-Vite must match between the root and packed-consumer fixture. Playwright Test
-must match the digest-pinned container and its browser binaries. Update either
-set manually and review any affected browser snapshots. The packed-consumer
-lockfile has separate Dependabot security coverage and is included in
-`npm run security:audit`, but its routine updates remain part of this coordinated
-process.
+Vite builds the maintained browser fixture that feeds zero-tolerance visual
+baselines, and Vitest may resolve its own Vite dependency. Review and update
+those packages together, then synchronize the packed consumer's Vite version so
+it remains representative of the supported toolchain. Playwright Test must
+match the digest-pinned container and its browser binaries. Update either set
+manually and review any affected browser snapshots.
+
+GitHub's repository-level dependency security features are expected to cover
+the tracked packed-consumer lockfile. `npm run security:audit` also checks that
+independent lockfile explicitly; its routine updates remain part of the manual
+coordination process.
 
 ## Checks