chore(deps): keep majors out of Dependabot groups; make js-yaml import v5-ready

[nilhemdot]

Summary

Fixes two problems found while going through the first round of Dependabot PRs.

Changes

• .github/dependabot.yml: the next-react, types and lint groups accepted major updates. As a result, the lint group (chore(deps): Bump the lint group across 1 directory with 2 updates #11, now closed) bundled ESLint 9 → 10, which no longer ships @eslint/js, so npm run lint crashed and the whole group failed. Grouped PRs now only bundle minor and patch updates; each major update arrives as its own PR.
• src/lib/hermesMcp.ts, src/lib/pipeline.ts: changed import yaml from "js-yaml" to import * as yaml from "js-yaml". js-yaml 5 removed the default export, which broke next build on chore(deps): Bump js-yaml from 4.3.2 to 5.4.2 in /source #14. Both files only call yaml.load and yaml.dump, so the new import works on 4.x and 5.x. Behaviour is unchanged today, and chore(deps): Bump js-yaml from 4.3.2 to 5.4.2 in /source #14 becomes mergeable once this lands.

Testing

• npm run typecheck: passes on js-yaml 4.3.2 and 5.4.2
• npm run lint: 0 errors
• npm test: 406 passed, 2 skipped, on both versions
• npm run eval: not run (no eval-relevant code changed)
• npm run build: passes on both versions
• Manually exercised in the dashboard

Security checklist

• No direct child_process imports in src/app/** or src/features/**
• No secrets, API keys, .env files or personal config committed
• No new dependencies

🤖 Generated with Claude Code

https://claude.ai/code/session_01KddPyDgHXVotgYiCUfYS3e

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Automated update requests are now grouped so major changes are handled separately from minor and patch changes.
  • An internal import adjustment was made without changing application behavior.

No end-user-visible features or behavior changes are included in this release.

Confidence Score: 5/5

The PR appears safe to merge; no actionable failure was established.

Summary

The PR limits three Dependabot groups to minor and patch updates and changes two js-yaml imports to namespace imports for compatibility with a future major version.

• Major dependency updates are intended to receive separate PRs.
• YAML load and dump call sites are unchanged.

_{Reviews (1) · Last reviewed commit: "chore(deps): keep majors out of Dependab..."}

[ecc-tools]

ECC Tools / Security Evidence

Commit: 02254ee75523eb1beb8b078ba7208f3cc37f4231

Security scanner evidence required (action_required)

Detected 1 security-sensitive predictive risk signal(s) without scanner evidence.

Mode: enforce

Findings:

• Security-sensitive changes may ship without scanner evidence: The PR touches billing, secrets, auth, webhooks, agent, or CI-sensitive surfaces without adding obvious security scanner, code scanning, or security-focused validation evidence. (1 security-sensitive paths changed; 0 security scanner or security-focused validation artifacts changed)

Touched security-sensitive paths:

• .github/dependabot.yml

Expected evidence:

• Security scanner, code scanning, secret scanning, dependency/security review, or focused security regression output.
• SARIF/code-scanning upload or equivalent pass/fail gate for the changed surface.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Risk Taxonomy

Commit: 02254ee75523eb1beb8b078ba7208f3cc37f4231

PR taxonomy review recommended (neutral)

Detected 2 PR taxonomy bucket(s): Security Evidence, CI/CD Recommendation.

Scanned 3 changed file(s).

Roadmap taxonomy buckets:

Security Evidence

Security-sensitive changes should carry explicit scanner, code-scanning, or focused regression evidence.

Signals:

• Security-sensitive changes may ship without scanner evidence
• 0 security-sensitive path(s) changed

Paths:

• .github/dependabot.yml
• source/src/lib/hermesMcp.ts
• source/src/lib/pipeline.ts

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

• Regression coverage may lag behind the diff
• 0 CI or workflow path(s) changed

Paths:

• .github/dependabot.yml
• source/src/lib/hermesMcp.ts
• source/src/lib/pipeline.ts

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agent-os	Ready	Preview	Oct 4, 2026 2:04am UTC

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 78642dd6-325b-4b57-b50e-c0f5216a6700

📥 Commits

Reviewing files that changed from the base of the PR and between 9408920 and 02254ee.

📒 Files selected for processing (3)

• .github/dependabot.yml
• source/src/lib/hermesMcp.ts
• source/src/lib/pipeline.ts

 _________________________________________________
< Untangling your code like a pair of headphones. >
 -------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ecc-tools]

ECC Tools / Reference Set Readiness

Commit: 02254ee75523eb1beb8b078ba7208f3cc37f4231

Reference set readiness gaps detected (neutral)

Reference evidence present for 0/7 areas (0%) across 3 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Hosted Promotion Readiness

Commit: 02254ee75523eb1beb8b078ba7208f3cc37f4231

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 3 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[nilhemdot]

Test (windows-latest) fails in Run tests, the same known Windows-only failure that already happens on main (backlog M8-6). It doesn't block merging and isn't caused by this PR. All required checks pass.

---

Generated by Claude Code

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• .github/dependabot.yml
• source/src/lib/hermesMcp.ts
• source/src/lib/pipeline.ts

---

_{Reviewed by free · Input: 521.3K · Output: 7.7K · Cached: 25.8K}

[graphify-labs]

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

---

Graphify review — findings

Restricts the next-react, types and lint Dependabot groups to minor/patch bumps, so every major upgrade (e.g. ESLint 10) arrives as its own PR instead of sinking a whole group. Also switches hermesMcp and pipeline to a namespace import of js-yaml (import * as yaml) instead of the default import.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 72 functions depend on the 59 functions this change touches.

Health — this change adds coupling hotspots:

• new: buildArtifact() — 0 callers, 7 callees

Verification — 72 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 886150e, 2 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 72 function(s) in the blast radius were not formally verified this run

· 1 more finding(s) on lines outside this diff (see the check run).