build: една версия на Node навсякъде (24) и Dependabot за npm

.devcontainer/Dockerfile

@@ -1,10 +1,10 @@
-# Digest-pinned to the 22-bookworm multi-arch index resolved on 2026-06-16.
+# Digest-pinned to the 24-bookworm multi-arch index resolved on 2026-09-02.
 # The tag is kept for readability; the @sha256 is what actually pins the image.
 # Re-resolve with: curl -fsSL -D - -o /dev/null \
 #   -H 'Accept: application/vnd.oci.image.index.v1+json' \
-#   https://mcr.microsoft.com/v2/devcontainers/typescript-node/manifests/22-bookworm \
+#   https://mcr.microsoft.com/v2/devcontainers/typescript-node/manifests/24-bookworm \
 #   | grep -i docker-content-digest
-FROM mcr.microsoft.com/devcontainers/typescript-node:22-bookworm@sha256:59e8c044af4ed4795967188c3d0b9bc677f42d42b0ff41f98c8be5333defeb64
+FROM mcr.microsoft.com/devcontainers/typescript-node:24-bookworm@sha256:3c84ba4842b181e699f9494842dbf737a3c96cc3a6028dd83f9a9d9b6f059d1a
 
 ARG WRANGLER_VERSION=4
 # uv installer is fetched from a version-pinned path (astral.sh/uv/<ver>/install.sh),

.github/dependabot.yml

@@ -1,8 +1,22 @@
-# Keeps the SHA-pinned GitHub Actions in .github/workflows/ fresh. Dependabot rewrites the pinned
-# commit SHA and updates the trailing `# vX.Y.Z` comment, so we keep the supply-chain safety of
-# pinning without the pins silently going stale. Scoped to github-actions only — the npm/pnpm
-# dependency surface is handled separately (and the security-sensitive @babel/core pin is a manual
-# override in pnpm-workspace.yaml).
+# Two surfaces, one file.
+#
+# GitHub Actions: keeps the SHA-pinned actions in .github/workflows/ fresh. Dependabot rewrites the
+# pinned commit SHA and updates the trailing `# vX.Y.Z` comment, so we keep the supply-chain safety of
+# pinning without the pins silently going stale.
+#
+# npm/pnpm: until 2026-09-02 this surface had NO automation, and advisories reached us only when the
+# Dependency audit step turned main red (browserslist, that day). Weekly minor+patch bumps arrive as
+# ONE grouped PR. Majors are NOT grouped: each comes as its own PR — but only while no grouped
+# minor/patch PR is open for that dependency, because Dependabot marks a grouped PR's members as
+# handled before it looks at ungrouped updates (dependabot/dependabot-core#14202). Merging (or
+# closing) the weekly PR promptly is what keeps majors flowing; a second group would not fix this,
+# it would just batch the majors and add the reverse suppression. The majors listed under `ignore`
+# are deferred past the release (each is a migration with its own risk) and are SUPPRESSED, not
+# surfaced — delete an entry to see it again. Security updates are not configured here: GitHub raises
+# them on its own once enabled for the repo, and the Dependency audit step (osv-scanner) fails CI on a
+# real advisory regardless of Dependabot. The security-sensitive pins (browserslist, undici, …) are
+# overrides in pnpm-workspace.yaml, maintained by hand: a pnpm override is a REPLACEMENT of every
+# resolution, not a floor, so a Dependabot PR that needs a newer one must lift the override with it.
 version: 2
 updates:
   - package-ecosystem: github-actions
@@ -17,3 +31,39 @@ updates:
     commit-message:
       prefix: ci
       include: scope
+
+  - package-ecosystem: npm
+    directory: '/'
+    schedule:
+      interval: weekly
+      day: monday
+      time: '06:00'
+      timezone: Europe/Sofia
+    open-pull-requests-limit: 5
+    groups:
+      # minor + patch in one weekly PR — one CI run, one review, instead of ten small ones. Majors stay
+      # ungrouped on purpose (see the header for the #14202 caveat).
+      minor-and-patch:
+        update-types: [minor, patch]
+    # majors deferred past the release (see the header) — suppressed until an entry is removed
+    ignore:
+      - dependency-name: react-router
+        update-types: [version-update:semver-major]
+      - dependency-name: '@react-router/*'
+        update-types: [version-update:semver-major]
+      - dependency-name: typescript
+        update-types: [version-update:semver-major]
+      - dependency-name: '@ai-sdk/*'
+        update-types: [version-update:semver-major]
+      - dependency-name: ai
+        update-types: [version-update:semver-major]
+      - dependency-name: '@cloudflare/workers-types'
+        update-types: [version-update:semver-major]
+      # jsdom 30 needs undici ^8.9, while pnpm-workspace.yaml overrides undici to ^7.29 — and a pnpm
+      # override is a REPLACEMENT, not a floor, so that PR would install an unsupported graph. Lift both
+      # together, not one at a time.
+      - dependency-name: jsdom
+        update-types: [version-update:semver-major]
+    commit-message:
+      prefix: build
+      include: scope

.github/workflows/ci.yml

@@ -58,7 +58,7 @@ jobs:
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Dependency audit

.github/workflows/deploy.yml

@@ -86,7 +86,7 @@ jobs:
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
 

.github/workflows/scripts-test.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version: 24
       # node:test only — the scripts under test import nothing outside node built-ins and each other,
       # so no `pnpm install` is required. The one external dependency is the `sqlite3` binary, which
       # ship-e2e.test.mjs drives as the real target its fake wrangler writes into; it ships with the
@@ -33,8 +33,10 @@ jobs:
   # свързани-лица pipeline tests — the CACBG leg (parse/classify/load/audit/extract) and the
   # Търговски регистър leg (scripts/tr: ЕИК checksum, HTTP client, deed cache). These use node:sqlite
   # (DatabaseSync) and import the shared companyNameKey .ts via the register-ts resolve hook, so they
-  # need Node 24 (node:sqlite + native TS type-stripping, no experimental flag) rather than the Node 22
-  # above. The libel-critical resolution logic gates merges here.
+  # need Node 24 (node:sqlite + native TS type-stripping, no experimental flag) — which is now the one
+  # Node version everywhere (.node-version, engines, every workflow, the devcontainer), so the split
+  # between the two jobs is about node_modules, not the runtime. The libel-critical resolution logic
+  # gates merges here.
   cacbg:
     runs-on: ubuntu-latest
     timeout-minutes: 10

.node-version

@@ -0,0 +1 @@
+24

.nvmrc

@@ -0,0 +1 @@
+24

CONTRIBUTING.md

@@ -18,7 +18,7 @@
 ## Среда за разработка
 
 Хранилището е пригодено за **Devcontainer** (нужни са Docker или съвместим и редактор с
-поддръжка на devcontainer). Изисквания извън контейнера: Node `>=22` и `pnpm` (виж
+поддръжка на devcontainer). Изисквания извън контейнера: Node `>=24` и `pnpm` (виж
 `packageManager` в `package.json`).
 
 ```bash

package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "packageManager": "pnpm@10.33.0",
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "scripts": {
     "dev": "turbo run dev",