chore(deps): safe updates, and Renovate opens PRs again

.github/workflows/ci.yml

@@ -2,11 +2,14 @@ name: CI
 
 on:
   push:
-    branches: [main, dev, "feat/**", "feature/**"]
+    branches: [main, dev, "feat/**", "feature/**", "renovate/**"]
   pull_request:
 
 jobs:
   ci:
+    # Renovate's branches run on push, before their PR exists: prCreation "not-pending" waits for
+    # this result (docs/09 §10). The pull_request run of the same PR would only repeat it.
+    if: github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -25,7 +28,7 @@ jobs:
       - run: pnpm visual # the UI's states against the committed e2e/visual/linux screenshots (N9)
       - name: Upload visual diffs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: visual-diffs
           path: e2e/visual/.out/

docs/09-engineering-notes.md

@@ -665,10 +665,17 @@ that registry is the intended extension point.
 <https://github.com/apps/renovate> — a repository setting, nothing in the repo). The rules, and
 why:
 
-- **Weekly, grouped.** Everything minor and patch arrives as one PR before Monday 6:00
-  (Europe/Vienna); majors come one by one. A version has to be three days old
-  (`minimumReleaseAge`), which gives a compromised release time to be pulled. Lockfile
-  maintenance once a month. Vulnerabilities reported by OSV skip the schedule.
+- **Weekly, grouped.** Everything minor and patch arrives as one PR on Monday (Europe/Vienna).
+  A major waits in the Dependency Dashboard issue until someone ticks it there, then comes as a
+  PR of its own. A version has to be three days old (`minimumReleaseAge`), which gives a
+  compromised release time to be pulled. Lockfile maintenance once a month. Vulnerabilities
+  reported by OSV skip the schedule.
+- **Why majors wait for a tick, and why the window is the whole Monday.** Renovate keeps at
+  most five branches (`branchConcurrentLimit` inherits `prConcurrentLimit`), and a branch
+  without a PR counts too. In October 2026 TypeScript 7, Vite 8 and Vitest 5 sat on three of
+  the five slots, so every other update showed up as "Rate-Limited" on the dashboard. A
+  window of a few hours on Monday morning also left room for only one or two Renovate runs a
+  week, so `prHourlyLimit` is off as well (0).
 - **Automerge only for dev-dependency patches**, and only after CI is green — which here means
   typecheck, unit tests, the smoke run on the built bundle, the pixel comparison, the size budget
   and the site build. Everything that ships in the bundle (`dependencies`, the MapLibre peer) is
@@ -695,9 +702,20 @@ why:
   was tried on 2026-10-19 and makes a fresh resolution fail outright
   (`ERR_PNPM_NO_MATURE_MATCHING_VERSION`) whenever some dependent demands a version younger than
   that, and `pnpm update` refuses to run non-interactively under it.
-- **Node itself only as a major.** Renovate reads `node-version: 24` and `engines.node: ">=24"`
-  as the dependency `node` and would pin both to the latest patch release every week; minor,
-  patch and pin updates of `node` are disabled, a new LTS major still arrives as a PR.
+- **CI runs on every push to `renovate/**`**, and skips the `pull_request` run of those PRs.
+  `not-pending` waits for a check on the branch, and Renovate does not count its own
+  `renovate/stability-days` as one. Without a CI run before the PR existed it waited the full
+  `prNotPendingHours` (25 h). By then the Monday window was over, so the branches sat on the
+  dashboard under "Awaiting Schedule": no Renovate PR opened between 2026-10-19 and 2026-10-29.
+- **Node in the workflows only as a major.** Renovate reads `node-version: 24` as the dependency
+  `node` and would pin it to the latest patch release every week. Minor, patch, pin and bump
+  updates of `node` are disabled. `bump` is what `rangeStrategy: bump` makes of `24` →
+  `24.22.1`, and without it that weekly PR came back. A new LTS major waits on the dashboard
+  like any other major.
+- **`engines.node` by hand.** It says which Node a user may run (`>=24` for the workspace,
+  `>=22` for `map0-check`). Raising it is a breaking change for `map0-check` users, not a
+  dependency update, so Renovate leaves `engines` alone. `@types/node` stays below 23 to match
+  `map0-check`'s oldest supported Node. Raise both together.
 
 `SECURITY.md` is the other half of low-effort maintenance: it sends reporters to GitHub's
 private vulnerability reporting instead of a public issue. That form exists only once

package.json

@@ -7,7 +7,7 @@
   "engines": {
     "node": ">=24"
   },
-  "packageManager": "pnpm@12.14.0+sha512.c18ba6d87993d3d164cb5e8948f32b2c06ee854487e06cd8d86781342fb3e5bb4634367034711e86802baa9c37bea906ce1929ad08d70884c97d801df13389a6",
+  "packageManager": "pnpm@12.16.1+sha512.091d1dee7927575661b25dab3c2ae31cafc1c54d6b71ed6a6600cf0c1cb10434a447eae14015f1b23e2e6bedeed79df94a932e2164d2832280dce3fb32f656d1",
   "scripts": {
     "dev": "vite --config site/vite.config.ts",
     "build": "pnpm --filter @map0/ui build",
@@ -31,16 +31,16 @@
   "devDependencies": {
     "@fontsource-variable/inter": "^5.3.0",
     "@release-it/conventional-changelog": "^12.0.2",
-    "ace-builds": "^1.45.0",
+    "ace-builds": "^1.45.2",
     "dts-bundle-generator": "^9.5.1",
     "jsonc-parser": "^3.3.1",
-    "node-html-parser": "^9.0.4",
+    "node-html-parser": "^9.0.5",
     "pixelmatch": "^8.0.0",
     "playwright": "^1.64.1",
     "pngjs": "^7.0.0",
     "release-it": "^21.1.1",
     "typescript": "^5.9.3",
-    "vite": "^6.4.4",
-    "vitest": "^4.1.12"
+    "vite": "^6.4.5",
+    "vitest": "^5.0.5"
   }
 }

packages/configurator/package.json

@@ -13,6 +13,6 @@
     "@map0/core": "workspace:*",
     "@map0/schema": "workspace:*",
     "@map0/ui": "workspace:*",
-    "lit": "^3.2.0"
+    "lit": "^3.3.3"
   }
 }

packages/core/package.json

@@ -11,13 +11,13 @@
   },
   "dependencies": {
     "@camptocamp/ogc-client": "^2.0.2",
-    "@geomatico/maplibre-cog-protocol": "^0.9.3",
+    "@geomatico/maplibre-cog-protocol": "^0.10.0",
     "@map0/schema": "workspace:*",
     "@tmcw/togeojson": "^7.1.3",
-    "hyparquet": "^1.31.4",
+    "hyparquet": "^1.31.5",
     "hyparquet-compressors": "^1.1.2",
     "jspdf": "^4.2.1",
-    "maplibre-gl": "^6.14.0",
+    "maplibre-gl": "^6.16.0",
     "pmtiles": "^4.5.0",
     "proj4": "^2.22.0"
   },

packages/ui/package.json

@@ -18,9 +18,9 @@
     "@map0/schema": "workspace:*",
     "dompurify": "^3.4.17",
     "lit": "^3.3.3",
-    "maplibre-gl": "^6.14.0"
+    "maplibre-gl": "^6.16.0"
   },
   "devDependencies": {
-    "vite": "^6.4.4"
+    "vite": "^6.4.5"
   }
 }