[avner-m]

Why

All 145 Dependabot PRs in this repo so far are one-advisory, one-lockfile security updates. With 11 independent lockfiles, one advisory fans out into several PRs. For example, nanoid produced #317, #319, #320, #322 and #323. Merging one PR also lets the next transitive bump surface. Nothing builds the apps in CI, so a breaking bump can merge unnoticed: #364 moved interaction-hook-app to Tailwind 4, and its production build has failed on master since.

What

Weekly refresh (deps-weekly-refresh.yml, scripts/deps/refresh.mjs). On Mondays at 09:00 NZDT, each JS app's lockfile is re-resolved to the newest versions its package.json ranges allow, transitive dependencies included. The result is one rolling PR from deps/weekly-refresh, listing the changes per app.

• package.json is never changed.
• Releases newer than 3 days are skipped, matching the npmMinimalAgeGate already set in the Yarn apps.
• The private MATTR SDK lock entries are kept as they are, so the refresh needs no registry token.
• If a refresh would move a package that has a patch-package patch (currently @expo/cli@55.0.32 in the remote verification apps), that app's lockfile is reverted and the PR says why.

Dependabot (dependabot.yml) now only opens what the refresh can't do:

• npm: majors, grouped by dependency across apps. Next and React move together as one group. Security fixes have their own group.
• React Native tutorials: majors of Expo, React Native, React and @mattrglobal/* are excluded, because they're upgraded together with the Learn tutorials.
• Other ecosystems: Gradle (excluding the locally supplied MATTR SDK), Docker and GitHub Actions, each in one group.
• Schedule: Monday 09:00 Pacific/Auckland, the same as Learn.

CI gate (ci-apps.yml) runs on PRs, for each changed JS app:

• a frozen-lockfile install
• npm run build for the Next.js apps
• tsc --noEmit for the complete React Native apps, but only when an NPM_TOKEN secret exists, because they install the private SDK. Without one they're skipped with a notice.

The native apps are skipped. The refresh PR is opened with GITHUB_TOKEN, so the refresh workflow dispatches ci-apps on the PR branch itself.

interaction-hook-app fix:

• Tailwind 4 migration: @tailwindcss/postcss replaces the v3 PostCSS plugin and autoprefixer, and globals.css uses @import "tailwindcss". The unused v3 tailwind.config.ts is removed, since its only customizations were two gradient utilities nothing referenced.
• Prerender fix: the build also failed to prerender / because useSearchParams() had no Suspense boundary. I wrapped the children in layout.tsx with <Suspense>, which leaves the tutorial code in page.tsx unchanged.

Action SHAs are pinned to versions already in sre-github mattr/actions/sha.tf.

Before merging

• Repo setting Actions > General > Allow GitHub Actions to create and approve pull requests is on. The refresh PR is opened with GITHUB_TOKEN.
• Optional: an NPM_TOKEN repo secret, if you want CI to type-check the React Native apps.

Verification

• node --test scripts/deps/lockfile.test.mjs: 4 passing. All 11 real lockfiles parse.
• Ran the refresh locally on the npm apps: lockfiles updated, package.json untouched, and the report lists direct and transitive changes per app.
• interaction-hook-app:
  • Frozen npm ci passes.
  • next build compiles and prerenders all routes, with Tailwind 4 CSS generated. The sandbox couldn't download Google Fonts, so this was a webpack build with a mocked font response. CI fetches the font normally.
• actionlint is clean on both new workflows, and dependabot.yml parses.
• Not verified locally: the Yarn 4 refresh path, because the sandbox couldn't reach the registry through Yarn. The first workflow_dispatch after merge is its first real run.

🤖 Generated with Claude Code