Fix broken auto-update CI job; pin typescript to v6, harden against unreviewed major bumps

[alexey-max-fedorov]

Root cause

The suspicion going in was "TypeScript v7 broke CI because Vercel's Next.js deployer only supports v6." That narrative doesn't hold for this repo: P-NP has no Next.js/Vercel deployment anywhere in its workflows — it's an esbuild-based static file patcher (build.mjs → esbuild, no tsc in the build path). Confirmed locally: typecheck, build, and the full test suite (37/37) all pass cleanly under both typescript 6.0.3 and 7.0.2.

What's actually red on GitHub Actions right now is the BetterDependabot workflow (custom cron job, .github/workflows/BetterDependabot.yml, pushes directly to master with no PR/CI gate). Its most recent run (2026-07-13, run 29218036062) fails during pnpm/action-setup@v6 because it's pinned to version: latest, and pnpm's own self-installer currently has a bug switching from v11.7.0 → v11.12.0:

[ERROR] Cannot use 'in' operator to search for 'integrity' in undefined
    at createFullPkgId (.../pnpm.mjs:154891:19)
##[error]Something went wrong, self-installer exits with code 1

Separately, but for the same underlying reason (this job auto-updates to "latest" with zero constraints and zero review), it silently bumped typescript from ^6.0.3 to ^7.0.2 on 2026-07-03 (commit 5a5cf60) via pnpm update --latest, committed and pushed straight to master. That went completely unvalidated because Build Check and Dependency Review only trigger on pull_request — this job bypasses both. It happens not to break anything today, but the process gap that let it happen unreviewed is real and worth closing regardless.

Hypotheses considered and ruled out

• TS v7 vs Vercel/Next.js incompatibility — ruled out; no Next.js/Vercel in this repo at all.
• Unrelated build/test regression — ruled out; typecheck/build/test are all green on both TS versions.
• Flaky external dependency — a one-off runner-acquisition flake hit the npm_and_yarn/github_actions Dependabot Update jobs on 2026-07-09 ("job was not acquired by Runner... after multiple attempts"), but it self-resolved the next day and isn't the persistent issue.
• Broken auto-update workflow — confirmed. BetterDependabot.yml's unpinned pnpm/action-setup@v6 version: latest is the actual currently-failing job, and its unpinned pnpm update --latest is how typescript silently jumped two majors with no review.

Fix

• .github/workflows/BetterDependabot.yml: pin pnpm/action-setup to version: 10 (matches build.yml/patch.yml convention) — fixes the actual current failure.
• .github/workflows/BetterDependabot.yml: drop --latest from pnpm update, so this unattended, directly-pushed-to-master job stays within package.json's declared semver ranges and can never again silently cross a major version.
• package.json / pnpm-lock.yaml: revert typescript to ^6.0.3 (the last version that actually went through a reviewed Dependabot PR + passing Build Check) and regenerate the lockfile.
• .github/dependabot.yml: add a semver-major ignore rule for typescript as defense-in-depth on the PR-based update path too.

Verification

Ran the exact CI sequence locally with pnpm 10 (matching the version pinned in build.yml/patch.yml):

CI=true pnpm install --frozen-lockfile   # clean, matches lockfile
pnpm build                                # esbuild bundle, OK
pnpm typecheck                            # tsc --noEmit, OK
pnpm test                                 # 37/37 passing

All green before (typescript 7.0.2) and after (typescript 6.0.3) this change — confirming the codebase itself was never the problem.

[Copilot]

Pull request overview

This PR stabilizes the repo’s automated dependency update pipeline by fixing the failing BetterDependabot GitHub Actions workflow and preventing unattended, direct-to-master updates from crossing major versions (specifically reverting the unreviewed TypeScript v7 bump back to v6).

Changes:

• Pin pnpm/action-setup to pnpm v10 in BetterDependabot.yml to avoid breakage from version: latest.
• Remove --latest from the unattended pnpm update step to keep updates within declared semver ranges.
• Revert TypeScript from ^7.0.2 back to ^6.0.3, update lockfile accordingly, and add a Dependabot semver-major ignore rule for TypeScript.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
pnpm-lock.yaml	Regenerates the lockfile to align with TypeScript v6.0.3 (removing v7 artifacts).
package.json	Pins typescript back to ^6.0.3 in devDependencies.
.github/workflows/BetterDependabot.yml	Fixes the broken auto-update job by pinning pnpm to v10 and preventing major bumps via pnpm update semantics.
.github/dependabot.yml	Adds defense-in-depth by ignoring semver-major updates for TypeScript in Dependabot PRs.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.