fix(ci): unblock validate workflow

[jeffreylouden]

Problem

pnpm audit --audit-level=high ran as the first step of the single
validate job, so five high advisories in dev-only transitive deps skipped
every data check behind it. The Validate check has been red on every open PR
since 2026-07-21 regardless of content, and each failing run lasted ~20s
because it never got past step 5 of 14.

Root cause

Not an unpatched range. The lockfile had not been re-resolved since
2026-07-17, and every vulnerable package was floatable within its existing
semver range, so pnpm install --frozen-lockfile faithfully reinstalled
stale, now-vulnerable resolutions:

Package	Advisory	Was	Now
js-yaml	GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj	4.2.0	gone from tree
postcss	GHSA-r28c-9q8g-f849	8.5.15	8.5.26
nanoid	GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8	3.3.13	3.3.18

Worth noting for next time: pnpm update --depth Infinity is not enough.
It floats js-yaml but leaves peer-suffixed vite pinned. Deleting
pnpm-lock.yaml alone is also not enough, because pnpm reuses what is already
in node_modules. A genuine re-resolve needs both removed.

Changes

Split the audit into its own job. An advisory is published upstream with
no change to this repo, so an audit sequenced ahead of data validation makes
every catalog PR red for reasons unrelated to the catalog. As a separate job
it still blocks dependency hygiene, but it can never again mask whether the
data is valid. The trigger paths now include the dependency manifests too:
renovate PRs previously matched none of data/**, schema/**, scripts/**
and so got no Validate run at all.

Retired the js-yaml and read-yaml-file overrides. @changesets/cli 3.0.0
moved to the ESM @manypkg/get-packages 3.x (@manypkg/tools +
@manypkg/find-root), which drops read-yaml-file entirely. Both packages
are now absent from the tree, which is exactly the unlock the override comment
in pnpm-workspace.yaml predicted.

No new overrides. postcss and nanoid clear themselves once the lockfile is
genuinely re-resolved, so the fix is the float, not a pin. The two remaining
overrides (vite, esbuild) are pre-existing and untouched.

Regenerated schema/json/hardware.json. Stale since #595 removed
bluetooth/wifi from schema/io-types.yaml without regenerating. This was
a second latent failure the audit had been masking: the "Check JSON schemas
are up to date" step would have failed even after the dependency fix. No data
entry uses either io type.

Verification

Run against a pristine clone of this branch, matching CI:

• pnpm install --frozen-lockfile — pass
• pnpm audit --audit-level=high — no known vulnerabilities, exit 0
• lint, test, typecheck, validate, validate:translations, format:check — pass
• generate:schemas and generate:context — no drift
• check-id-immutability, pnpm build 0 — pass (12,493 products)
• pnpm changeset status --since=HEAD, the release-tooling load-path oracle
  that guards the changesets upgrade — exit 0
• pnpm why nanoid — 3.3.18 under postcss, 5.1.16 as the direct devDependency

Note

@changesets/cli 3.0.0 published 2026-08-11, so pnpm recorded a
minimumReleaseAgeExclude entry for the 14 @changesets/* packages and it
lands ahead of renovate's stabilityDays: 3. The oracle above is the guard
that made this safe to take early.

No changeset: no data/*.yaml changes, so the Changeset workflow's data check
is skipped by design.

Refs AUREO-781

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7ff6650

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b0d33672-dc8d-492c-bbc7-188e01692ae7

📥 Commits

Reviewing files that changed from the base of the PR and between 9d3ed12 and 1700014.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

Walkthrough

The pull request updates dependency tooling and security overrides, separates dependency auditing from catalog validation, expands workflow triggers for dependency changes, and removes bluetooth and wifi from the hardware schema enum.

Changes

Dependency validation

Layer / File(s)	Summary
Dependency versions and security policy package.json, pnpm-workspace.yaml	The Changesets CLI is upgraded to 3.0.0. Release-age exclusions are added for pinned Changesets packages. Obsolete dependency overrides are removed, while the vite and esbuild overrides remain.
Independent dependency audit .github/workflows/validate.yml	Dependency manifest changes now trigger validation. The high-severity audit runs in a separate job with its own checkout, Node.js and pnpm setup, dependency installation, and audit step.

Hardware schema

Layer / File(s)	Summary
Hardware signal type enum schema/json/hardware.json	The io[].type enum no longer permits bluetooth or wifi.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• existential-engineering/catalog#257: Both changes modify the validation workflow and dependency auditing.
• existential-engineering/catalog#427: Both changes update validation workflow behavior and dependency security overrides.
• existential-engineering/catalog#437: Both changes modify Changesets-related dependency configuration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary change: separating dependency auditing to unblock the validation workflow.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/aureo-781/validate-audit-advisories

---

_{Comment @coderabbitai help to get the list of available commands.}