[hibukki]

👋 Claude here

Reduces dependency rot and version duplication by making Node's version a single source of truth and adding automated dependency updates. No changes to package.json or pnpm-lock.yaml.

What changed

• .node-version → 22. Single source of truth for the Node version.
• .github/workflows/ci.yml:
  • node-version: 22 → node-version-file: .node-version (reads the SSOT above).
  • actions/checkout@v4 → @v6, actions/setup-node@v4 → @v5.
  • Kept pnpm/action-setup@v4 (it reads packageManager from package.json) and cache: pnpm.
  • Added a concurrency block so superseded runs on the same ref get cancelled.
  • lint / test / build steps unchanged in intent.
• .npmrc → engine-strict=true (enforces engines.node: ">=22") + update-notifier=false.
• convex.json → pins the Node action runtime to Node 22.
• .github/dependabot.yml → weekly updates for npm (/) and github-actions, minor+patch grouped (npm split into production / development by dependency-type), open-pull-requests-limit: 5.

convex.json schema

Verified against the official Convex docs before writing — the key is node.nodeVersion (string; supported "20"/"22"/"24"; requires convex >= 1.27.0, and this repo is on ^1.39.1):

Configuring the Node.js version: You can specify the Node.js version used by Node actions by setting the node.nodeVersion field in your convex.json.

Docs: https://docs.convex.dev/production/project-configuration

Verification

• pnpm install --frozen-lockfile succeeds with the new .npmrc (on Node >= 22, engine-strict doesn't block).
• pnpm lint passes.
• pnpm build passes.
• ci.yml, dependabot.yml, and convex.json all parse as well-formed YAML/JSON.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VrVv49ZydmFUGUVbVTGWeN

[claude]

Review: chore: dependency-rot cleanup

Nice, focused infra PR — no package.json/lockfile changes, small diff (44/-3 across 5 files), and the description is clear about what changed and why. Went through .node-version, ci.yml, .npmrc, convex.json, and dependabot.yml.

What it does

• Introduces .node-version (22) as the single source of truth for the Node version.
• ci.yml now reads node-version-file: .node-version instead of a hardcoded 22, bumps actions/checkout → v6 and actions/setup-node → v5, and adds a concurrency group to cancel superseded runs.
• Adds .npmrc with engine-strict=true + update-notifier=false.
• Adds convex.json pinning the Convex Node action runtime to "22".
• Adds .github/dependabot.yml for weekly npm + github-actions updates, grouped by minor/patch.

Consistency check (good)

• .node-version (22), package.json#engines.node (>=22), and convex.json#node.nodeVersion ("22") all agree — no drift between the three places Node version is expressed.
• .npmrc's engine-strict=true correctly enforces the existing engines field; this is a sensible pairing rather than a redundant addition, since it makes local npm/corepack installs fail fast on the wrong Node version too, not just CI.

Things worth double-checking before merge

• Action version bumps aren't verifiable from this diff alone. actions/checkout@v6 and actions/setup-node@v5 are pinned by major tag — worth confirming the PR's own CI run went green (I wasn't able to check run status from here) rather than assuming the tags resolve correctly, since a bad major bump here would break CI entirely rather than degrade gracefully.
• convex.json's $schema path (./node_modules/convex/schemas/convex.schema.json) couldn't be verified in this checkout since node_modules isn't installed here. It's a soft dependency (only affects editor autocomplete/validation, not runtime behavior), but worth a quick sanity check that the file actually exists at that path in the installed convex@^1.39.1 package.
• concurrency.group: ci-${{ github.ref }} applies to both the push (main) and pull_request triggers. That's the right call for this workflow since it's lint/test/build only (nothing that shouldn't be cancelled mid-flight, e.g. a deploy step) — just flagging it so it's a conscious tradeoff if a deploy step is ever added to this same job later.

Dependabot config

• Splitting npm updates into production/development groups and grouping github-actions separately is a reasonable, low-noise setup. Only grouping minor/patch (leaving majors ungrouped/individual) is a good default — it keeps potentially-breaking major bumps visible for manual review instead of silently bundling them.
• open-pull-requests-limit: 5 per ecosystem is a sane cap.

Test coverage

No tests needed here — this is pure CI/tooling configuration with no application logic. The PR description's manual verification steps (pnpm install --frozen-lockfile, pnpm lint, pnpm build, YAML/JSON parse checks) are the right verification for this kind of change.

Security

No concerns — no secrets, no new runtime dependencies, and the dependabot grouping strategy (majors excluded from auto-grouping) errs on the side of caution.

Overall: small, well-scoped, and internally consistent. The one thing I'd want confirmed before merging is that the bumped Action major versions (checkout@v6, setup-node@v5) actually exist and the PR's CI is green.