chore: update dependencies (2026-09-08) — supply-chain policy, openapi-fetch 0.17, explicit protocol trio

[bvalosek]

Routine dependency pass (/dfos-update-deps, now cross-repo). Dependabot is disabled on this repo as of 2026-09-08; this pass is the update vehicle.

Config converged

New .npmrc, matching the policy the sibling metalabel repos already run:

Setting	Purpose
minimum-release-age=10080	7-day quarantine on third-party publishes
trust-policy=no-downgrade	refuse a version with weaker provenance than a prior one
block-exotic-subdeps=true	no transitive git/URL/tarball deps
strict-peer-dependencies=true, engine-strict=true	unmet peers and wrong Node fail loudly
minimum-release-age-exclude[]	the three first-party @metalabel/* packages (same release train, adopted same-day)

package.json gains pnpm.overrides["@types/node"] = ^24.13.3 so a transitive @types/node can't drift past the Node line the package is built against.

Verified live, not inert: pnpm update --latest vitest resolved 4.1.11 rather than 5.0.0 because 5.0.0 (published 2026-09-03) is still inside the quarantine.

Updated

Package	Change	Notes
openapi-fetch	0.14.1 → 0.17.0	Emitted dist/index.d.ts diffed before/after: byte-identical (398.61 KB). 0.17's Readable/Writable wrappers are structural no-ops here (no --read-write-markers, zero markers in the generated types); mutual assignability with the raw schema types proven under full strictness incl. exactOptionalPropertyTypes. ClientOptions.fetch signature unchanged, so the signed-fetch seam holds. Additive: pathSerializer, per-request middleware, PathSerializer/MiddlewareRequestParams types. pnpm generate output byte-identical (co-released openapi-typescript already at 7.13.0).
@metalabel/dfos-protocol, @metalabel/dfos-web-relay	now explicit devDeps at 0.54.0	Strict peers exposed that the auto-installed peers of @metalabel/dfos-client@0.54.0 were still at 0.33.0 (skipLibCheck had been masking it; CI's frozen install never re-resolves). Pinning all three exactly makes the lockstep trio a manifest edit and makes strict peers the tripwire. devDeps only; published surface unaffected.
vitest	range ^4.1.8 → ^4.1.11	matches what's installed

Deferred

• vitest 4 → 5 — quarantined until 2026-09-10. Checked anyway: the suite uses no mock API, so the clearMocks flip and stricter vi.mock/expect.poll rules can't bite; config is root-level test.include only. Cheap follow-up. When taken, raise engines.node >=22 → >=22.12 to match vitest 5's own floor (deferred until then; nothing requires it today).
• @types/node 26 — stays on the Node 24 line (pin above).
• typescript 7 — dual-track by design (typescript7 alias runs typecheck); plain typescript stays for tsup/openapi-typescript.

Checks

Run from a clean node_modules:

Gate	Result
pnpm install --frozen-lockfile	exit 0, no peer warnings
pnpm typecheck	exit 0
pnpm test	2 files, 11 tests passed
pnpm build	ESM + DTS success
pnpm generate → diff	openapi.json and src/generated clean

No version bump: patch-level tooling per AGENTS.md; release stays deliberate.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EZfED2cWfs5cJTRK9GmjQs