Chore/fix dependabot alerts

.agents/skills/dep-upgrade/instructions.md

@@ -66,4 +66,10 @@ pnpm test:unit
 
 > **`pnpm check` tip:** If type errors appear and you have uncommitted changes, run `git stash && pnpm check 2>&1 | tail -5` to confirm whether errors are pre-existing. Restore with `git stash pop`. If there is nothing to stash, skip this check — without a baseline to compare against, it gives no useful signal.
 
+**Compare outputs, not only exit codes.** Passing commands do not prove that nothing changed. Before the change, save the outputs: ESLint JSON, the list and hashes of build files, and generated files. After the change, compare them.
+
+- First build twice with no change. Some files always differ (e.g. version stamps); leave them out of the comparison.
+- Check that the code you care about actually ran, for example by logging calls to the updated package during the build. If it never ran, "identical output" proves nothing.
+- A new version in the lockfile does not prove that the running code changed. Some packages bundle their own copy of a dependency, so check the entry point that is actually loaded.
+
 When done, rewrite plan.md as `AGENTS.md` Implementation Workflow step 6 describes, recording the verification results among the facts.

.claude/rules/dependencies.md

@@ -0,0 +1 @@
+../../docs/guides/agent-rules/dependencies.md

AGENTS.md

@@ -41,17 +41,18 @@ See `docs/guides/architecture.md` for detailed placement rules.
 
 Before planning or changing a matching path, read the corresponding document under `docs/guides/agent-rules/`.
 
-| Path                                 | Rules                                                         |
-| ------------------------------------ | ------------------------------------------------------------- |
-| All source and plans                 | `coding-style.md`                                             |
-| `prisma/**`, server and service code | `prisma-db.md`                                                |
-| `**/*.test.ts`, `src/test/**`        | `testing.md`                                                  |
-| `**/*.spec.ts`, `e2e/**`             | `testing-e2e.md`                                              |
-| Svelte components and stores         | `svelte-components.md`, `svelte-runes.md`, `accessibility.md` |
-| SvelteKit routes                     | `sveltekit.md`                                                |
-| Authentication and admin paths       | `auth.md`                                                     |
-| Server cache modules                 | `server-cache.md`                                             |
-| `.github/workflows/**`               | `github-actions.md`                                           |
+| Path                                                   | Rules                                                         |
+| ------------------------------------------------------ | ------------------------------------------------------------- |
+| All source and plans                                   | `coding-style.md`                                             |
+| `prisma/**`, server and service code                   | `prisma-db.md`                                                |
+| `**/*.test.ts`, `src/test/**`                          | `testing.md`                                                  |
+| `**/*.spec.ts`, `e2e/**`                               | `testing-e2e.md`                                              |
+| Svelte components and stores                           | `svelte-components.md`, `svelte-runes.md`, `accessibility.md` |
+| SvelteKit routes                                       | `sveltekit.md`                                                |
+| Authentication and admin paths                         | `auth.md`                                                     |
+| Server cache modules                                   | `server-cache.md`                                             |
+| `.github/workflows/**`                                 | `github-actions.md`                                           |
+| `package.json`, `pnpm-workspace.yaml`, `renovate.json` | `dependencies.md`                                             |
 
 Use project-specific workflows from `.agents/skills/` when a task matches a skill description. Each `.agents/skills/<name>/instructions.md` is a plain Markdown checklist — read it directly when doing that task by hand, not only when an agent loads it automatically.
 

docs/guides/agent-rules/dependencies.md

@@ -0,0 +1,26 @@
+---
+description: Dependency update and security override rules
+paths:
+  - 'package.json'
+  - 'pnpm-workspace.yaml'
+  - 'renovate.json'
+---
+
+# Dependencies
+
+## Fixing a Vulnerable Transitive Dependency
+
+Try these in order:
+
+1. **Remove it.** Check that the direct dependency that pulls it in is still used. If it is not, delete it.
+2. **Update the lockfile.** If the parent's declared range already allows the fixed version (e.g. `^8.12.1` and the fix is `8.12.3`), run `pnpm update <pkg>`. No override is needed.
+3. **Add an override.** Use it only when the fix is outside the parent's range.
+
+Before you choose 2 or 3, read the advisory's trigger conditions and check whether this project can reach them. If it cannot, dismissing the alert is a valid choice. Judge each advisory on its own: do not reuse the reasoning for one advisory to dismiss another advisory of the same package.
+
+## Writing Overrides
+
+- Make the upper bound equal to the pin: `'pkg@>=1.0.0 <1.1.21': '1.1.21'`. If they differ (`<1.1.13': '1.1.18'`), the pin can become vulnerable later, and the selector will never match it again.
+- Overrides ignore the parent's declared range. Pick the lowest fixed version that the parent accepts, not the latest one.
+- When you cross a major on purpose, check the API the parent actually uses, and add a comment that says when to remove the override.
+- When you review alerts, also check that each existing override still matches a package and that its pin is not vulnerable.

package.json

@@ -25,7 +25,6 @@
   "devDependencies": {
     "@dnd-kit/abstract": "0.5.3",
     "@dnd-kit/dom": "0.5.3",
-    "@eslint/eslintrc": "3.3.7",
     "@playwright/test": "1.64.1",
     "@quramy/prisma-fabbrica": "2.3.3",
     "@sveltejs/adapter-vercel": "7.0.2",