Consolidate Dependabot updates (#187)

* Consolidate Dependabot updates

* Allow Claude workflow responses

* Keep webpack dev server compatible

* Update websocket driver advisory fix

Author: justin808

.github/dependabot.yml

@@ -7,7 +7,7 @@ updates:
   - package-ecosystem: "bundler"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 5
     cooldown:
       default-days: 3
@@ -19,7 +19,7 @@ updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 5
     cooldown:
       default-days: 3
@@ -31,7 +31,7 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 5
     cooldown:
       default-days: 3

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
       DATABASE_URL: postgres://postgres:postgres@localhost:5432/react_on_rails_starter_tanstack_test
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 
@@ -81,7 +81,7 @@ jobs:
       PORT: 3100
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 
@@ -137,7 +137,7 @@ jobs:
       CABLE_DATABASE_URL: "postgres://postgres:postgres@localhost:5432/react_on_rails_starter_tanstack_production_cable"
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/claude-code-review.yml

@@ -21,19 +21,19 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
+      pull-requests: write
+      issues: write
       id-token: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 1
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1.0.154
+        uses: anthropics/claude-code-action@v1.0.163
         env:
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
         with:
@@ -43,4 +43,3 @@ jobs:
           prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
           # or https://code.claude.com/docs/en/cli-reference for available options
-

.github/workflows/claude.yml

@@ -20,19 +20,19 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
+      pull-requests: write
+      issues: write
       id-token: write
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1.0.154
+        uses: anthropics/claude-code-action@v1.0.163
         env:
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
         with:
@@ -49,4 +49,3 @@ jobs:
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
           # or https://code.claude.com/docs/en/cli-reference for available options
           # claude_args: '--allowed-tools Bash(gh pr *)'
-

.github/workflows/cpflow-promote-staging-to-production.yml

@@ -63,12 +63,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           persist-credentials: false
 
       - name: Checkout control-plane-flow actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           repository: shakacode/control-plane-flow
           ref: v5.1.1
@@ -456,7 +456,7 @@ jobs:
           echo "image=${staging_image}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c
 
       - name: Copy image from staging
         id: copy-image

Gemfile.lock

@@ -434,10 +434,10 @@ GEM
       net-ssh (>= 2.8.0)
       ostruct
     thor (1.5.0)
-    thruster (0.1.21)
-    thruster (0.1.21-aarch64-linux)
-    thruster (0.1.21-arm64-darwin)
-    thruster (0.1.21-x86_64-linux)
+    thruster (0.1.22)
+    thruster (0.1.22-aarch64-linux)
+    thruster (0.1.22-arm64-darwin)
+    thruster (0.1.22-x86_64-linux)
     timeout (0.6.1)
     traces (0.18.2)
     tsort (0.2.0)
@@ -453,7 +453,7 @@ GEM
       bindex (>= 0.4.0)
       railties (>= 8.0.0)
     websocket (1.2.11)
-    websocket-driver (0.8.1)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)

package.json

@@ -19,27 +19,27 @@
     "defaults"
   ],
   "dependencies": {
-    "@radix-ui/react-dialog": "^1.1.15",
-    "@radix-ui/react-dropdown-menu": "^2.1.16",
-    "@radix-ui/react-label": "^2.1.8",
-    "@radix-ui/react-separator": "^1.1.8",
+    "@radix-ui/react-dialog": "^1.1.18",
+    "@radix-ui/react-dropdown-menu": "^2.1.19",
+    "@radix-ui/react-label": "^2.1.11",
+    "@radix-ui/react-separator": "^1.1.11",
     "@radix-ui/react-slot": "^1.2.4",
-    "@radix-ui/react-tabs": "^1.1.13",
-    "@rspack/core": "2.0.4",
-    "@tailwindcss/postcss": "^4.3.0",
-    "@tanstack/react-query": "^5.100.13",
-    "@tanstack/react-query-devtools": "^5.100.13",
-    "@tanstack/react-router": "^1.170.7",
+    "@radix-ui/react-tabs": "^1.1.16",
+    "@rspack/core": "2.1.2",
+    "@tailwindcss/postcss": "^4.3.2",
+    "@tanstack/react-query": "^5.101.2",
+    "@tanstack/react-query-devtools": "^5.101.2",
+    "@tanstack/react-router": "^1.170.17",
     "@tanstack/react-router-devtools": "^1.167.0",
     "@tanstack/react-table": "^8.21.3",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "compression-webpack-plugin": "^12.0.0",
     "css-loader": "7.1.4",
     "css-minimizer-webpack-plugin": "8.0.0",
-    "lucide-react": "^1.16.0",
+    "lucide-react": "^1.23.0",
     "mini-css-extract-plugin": "2.10.2",
-    "postcss": "^8.5.15",
+    "postcss": "^8.5.16",
     "postcss-loader": "^8.2.1",
     "prop-types": "15.8.1",
     "react": "19.2.7",
@@ -49,31 +49,32 @@
     "react-on-rails-rsc": "19.2.1-rc.0",
     "react-server-dom-webpack": "19.2.7",
     "rspack-manifest-plugin": "5.2.2",
-    "sass": "1.99.0",
-    "sass-loader": "16.0.7",
+    "sass": "1.101.0",
+    "sass-loader": "17.0.0",
     "shakapacker": "10.2.0",
     "shakapacker-rspack": "10.2.0",
     "sonner": "^2.0.7",
     "style-loader": "4.0.0",
     "tailwind-merge": "^3.6.0",
-    "tailwindcss": "^4.3.0",
+    "tailwindcss": "^4.3.2",
     "tw-animate-css": "^1.4.0",
-    "webpack": "^5.101.0",
+    "webpack": "^5.108.4",
     "webpack-assets-manifest": "^6.0.0"
   },
   "devDependencies": {
-    "@playwright/test": "^1.60.0",
+    "@playwright/test": "^1.61.1",
     "@pmmmwh/react-refresh-webpack-plugin": "^0.6.1",
-    "@rspack/cli": "2.0.4",
-    "@rspack/dev-server": "2.0.1",
-    "@rspack/plugin-react-refresh": "2.0.0",
-    "@swc/core": "1.15.33",
-    "@types/react": "19.2.15",
+    "@rspack/cli": "2.1.2",
+    "@rspack/dev-server": "2.1.0",
+    "@rspack/plugin-react-refresh": "2.0.2",
+    "@swc/core": "1.15.43",
+    "@types/express": "^4.17.25",
+    "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
     "react-refresh": "0.18.0",
     "swc-loader": "0.2.7",
     "typescript": "6.0.3",
-    "webpack-cli": "^6.0.0",
-    "webpack-dev-server": "^5.2.5"
+    "webpack-cli": "^7.2.1",
+    "webpack-dev-server": "^5.2.6"
   }
 }