Distillation

Date: July 28, 2026

• 🔴 (10:50) User directive: Always review lore-managed sections in AGENTS.md before committing (remove entries that don't apply to the actual codebase)
• 🔴 (10:50) User directive/preference: always use ^ (or ~) instead of >= for version specifiers/overrides to stay within the compatible major line (pnpm overrides with >= can cross major versions and break APIs, e.g. ajv v6 vs v8)
• 🔴 (10:50) User directive: never try to manually resolve conflict markers in pnpm-lock.yaml
• 🔴 (10:50) User directive: Never manually resolve pnpm-lock — instead git checkout --theirs pnpm-lock.yaml then pnpm install to regenerate deterministically
• 🟡 (10:50) Branch fix/dependabot-security-alerts comprises 3 commits: c615cf3 (HEAD, "fix: resolve 9 Dependabot security alerts"), 22efc12 ("fix: use ^ specifiers and drop @tootallnate/once override"), 4abef6c ("fix: resolve 4 open Dependabot security alerts via pnpm overrides")
• 🟡 (10:50) Investigation finding: HEAD commit c615cf3 is clean of AGENTS.md (does NOT modify it — only docs/astro.config.mjs, docs/package.json, docs/pnpm-lock.yaml, docs/src/content.config.ts, package.json, pnpm-lock.yaml). However branch master...HEAD includes AGENTS.md lore churn (49 lines) via earlier commit 4abef6c — so PR #854 merge will ship AGENTS.md changes unless reverted via git restore.
• 🟡 (10:50) Verification Q1 (root lockfile): root pnpm-lock.yaml resolves brace-expansion@5.0.8 (lines 1961, 5266) and minimatch@10.2.6 (lines 2611, 5993); NO other versions of brace-expansion or minimatch exist anywhere in root lockfile.
• 🟡 (10:50) Verification Q1 (docs lockfile): docs/pnpm-lock.yaml resolves sharp@0.35.3 (lines 1813, 4381), astro@7.1.4 (lines 936, 2897), svgo@4.0.1 (lines 1861, 4457); docs lockfile contains NO brace-expansion or minimatch at all.
• 🟡 (10:50) Verification: docs/package.json has pnpm override svgo: ^4.0.1 (line 11 of docs/pnpm-lock.yaml overrides block); astro depends on svgo 4.0.1 (resolved at line 2940 of docs lockfile).
• 🟡 (10:50) HEAD commit c615cf3 Astro 7 migration specifics: docs/astro.config.mjs:27 changed Introduction slug from '' to 'index'; docs/astro.config.mjs:34 wrapped targets autogenerate as items: [{ autogenerate: { directory: 'targets' } }]; new docs/src/content.config.ts uses glob({ pattern: '**/*.{md,mdx}', base: './src/content/docs' }) + docsSchema(); package.json:105 added brace-expansion: ^5.0.8 override alongside minimatch: ^10.2.6.
• 🟡 (10:50) AGENTS.md branch-tip diff (commit 4abef6c, user-maintained lore) added entries: (1) ESM modules prevent vi.spyOn of child_process.spawnSync — use test subclass pattern, vi.mock at module level works but affects all tests in file; (2) lore tool (opencode-lore) seeds generic unrelated entries (shared UUID prefix 019c9aa1-*, references React/K8s in a Node CLI project) — review lore sections before committing, Cursor BugBot flags as "Irrelevant lore entries"; (3) pnpm-lock.yaml merge conflicts: regenerate via git checkout --theirs + pnpm install, never manual; (4) pnpm overrides with >= cross major versions (ajv v6 vs v8 broke eslint with 'Cannot set properties of undefined (setting defaultMeta)') — use ^; (5) Craft uses home-grown SemVer utils in src/utils/version.ts (parseVersion, versionGreaterOrEqualThan, isPreviewRelease) — don't add semver package for version comparisons, use existing utilities.
• 🟡 (10:51) Pending verification (Q3): glob's minimatch constraint in root and where glob/minimatch are used in craft source tooling — NOT yet confirmed at end of segment (assistant noted root/docs lockfiles clean of vulnerable copies, then moved to check glob usage).