[Copilot]

Why

Maintainers can review the eligible October dependency updates together instead of merging fourteen overlapping Dependabot PRs. This keeps the seven-day dependency policy unchanged.

What changes

The bundle updates Hub's JSON, SQLite, WebMock, jsdom, Prettier, Storybook and TypeScript ESLint dependencies; Starter's jsdom and Prettier dependencies; and the build action's Playwright and Prettier dependencies. It also updates Ruby setup in CI and pairs the release workflow's artifact upload and download upgrades. The new downloader rejects artifact digest mismatches instead of warning; the existing archive and directory layout stays unchanged.

Includes the changes from #85, #86, #87, #88, #89, #90, #91, #92, #93, #94, #95, #96, #97 and #98, preserving their versions and lockfile checksums. It excludes #66 because Storybook 10.6.3 fails dependency age. That version was published on October 20 at 09:52:08 UTC and reaches seven days on October 27 at 09:52:08 UTC; the bundle uses eligible Storybook 10.6.2 from #96 instead. No application code, stories, formatting rules or dependency policy changes.

The release-only artifact upload/download handoff remains unverified on GitHub because pull request CI does not execute that publishing workflow. No release was created to exercise it.

GitHub reports action_required for the combined PR's Hub, Starter, build-action and dependency-age workflows, with no jobs run. Those checks need maintainer action before the combined PR is verified on GitHub.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill.

An enterprise owner can allow the organization to be billed for reviews like this by enabling Copilot code review for users without a license.

[Copilot]

Assessed all 15 open Dependabot PRs against the repository's current contributor, agent, coding, documentation, dependency and PR guidance.

Source	Update	Dependency age CI	Assessment
#66	Hub Storybook 10.6.3	Failed	Excluded. Published October 20 at 09:52:08 UTC; eligible October 27 at 09:52:08 UTC. Use #96's older eligible patch instead.
#85	Hub WebMock 3.34.0	Passed	Included. Test dependency; reviewed query-matching and Rack-stub changes. Original CI has no failed checks.
#86	Build action Playwright 1.64.1	Passed	Included with matching playwright-core. Existing capture and packaging tests cover its use. Original CI has no failed checks.
#87	Release upload-artifact 7.0.2	Passed	Included with #91. Hosted runners support Node 24. Default archive mode preserves the named image-digest archives.
#88	Build action Prettier 3.9.10	Passed	Included. Original frontend shard 4 failed the canvas postMessage assertion at improvement-notes.test.tsx:473, not a formatting assertion. The failure did not recur in the combined full local Hub suite; no unrelated test edits.
#89	Hub sqlite3 2.10.0	Passed	Included with all seven native-platform packages and checksums. Reviewed SQLite 3.54 and result-set changes; no direct affected mutation APIs found. Original Rails and both production-image checks pass.
#90	Hub jsdom 30.1.3	Passed	Included with its exact DOM-selector and Undici updates. Original frontend and integration checks pass.
#91	Release download-artifact 8.0.2	Passed	Included with #87. Pattern-based downloads preserve separate named directories; single-artifact-ID path changes do not apply. Digest mismatches now fail instead of warning.
#92	Hub json 3.1.0	Passed	Included. Reviewed stricter generation of non-ASCII binary strings and Ruby compatibility. Original Rails and production-image checks pass.
#93	ruby/setup-ruby 1.329.0	Passed	Included. All nine existing references use the same immutable commit; inputs and Ruby version pins remain unchanged. Original affected jobs pass.
#94	Hub typescript-eslint 8.71.2	Passed	Included with matching parser, plugin and related packages. Compiler aliases and peer ranges remain unchanged. Original lint and type checks pass.
#95	Hub Prettier 3.9.10	Passed	Included with the other formatter updates. No source reformatting or configuration changes. Original lint check passes.
#96	Hub Storybook 10.6.2	Passed	Included instead of #66. Eligible patch includes security fixes. Original Storybook build passes; no stories or presentation code change.
#97	Starter jsdom 30.1.3	Passed	Included with its exact lockfile changes. Starter is excluded from repository age enforcement by existing policy; original Starter checks pass.
#98	Starter Prettier 3.9.10	Passed	Included with the matching Hub/build-action updates. Original Starter checks pass.

CodeQL is neutral, not failed, on these source PRs. The combined full local Hub suite passed, including the repository-wide age check for 658 dependencies. Starter's type check, tests, build and formatting check passed, as did build-action lint and all 48 build-action tests. Local Hub execution used the configured devcontainer, with sudo for this checkout's ownership and Node's system CA trust for the environment's registry certificate. GitHub CI on this combined PR remains a separate result.

The three npm lockfiles were compared against the exact union of the included PRs' changes, including transitive packages and checksums.

The artifact action migration retains zipped uploads and pattern-based downloads. Its new digest-mismatch failure is an intentional upstream integrity improvement. Actual GitHub artifact transfer remains unverified because the release workflow does not run on pull requests; no release or publishing operation was triggered.

The original Dependabot PRs remain open. This PR does not merge or close them.

[Copilot]

GitHub reports action_required for Hub CI, Starter CI, Build action CI and Dependency age, with no jobs run. A maintainer needs to resolve the required action before those combined-PR results are available. CodeQL completed successfully. The full local Hub suite, repository-wide dependency-age check, Starter checks and build-action suite passed; these do not replace GitHub CI.