Dependency maintenance pass — svelte + @types/node patch/major bumps, workspace isolation fix

Why Care?

Routine maintenance sweep to catch patch/minor drift after the Astro 7 upgrade landed. Nothing dramatic in the dependency graph itself, but the process surfaced a real isolation bug worth fixing: running pnpm outdated/pnpm install from inside this site was silently bleeding into the parent astro-knots workspace and rewriting its root pnpm-lock.yaml (it deleted the sites/cilantro-site importer entirely on one run). That’s now fixed at the source.

What’s New?

Package	Before	After
svelte	^5.56.3	^5.56.4
@types/node	^25.6.0	^26.1.0

@astrojs/db@0.21.3 shows as outdated with target Deprecated — the package has no newer version, it’s deprecated upstream in favor of a direct database client (Drizzle/Kysely). Already tracked as a separate migration in the prior changelog entry; out of scope for this patch/minor pass.

Fixes bundled with this pass

• Workspace isolation (pnpm-workspace.yaml, new file). Despite .npmrc already setting ignore-workspace=true, running pnpm install/pnpm outdated from this directory still resolved the parent astro-knots/pnpm-workspace.yaml as the workspace root (confirmed via pnpm list -r --depth -1 showing all 8 astro-knots workspace projects). A first pnpm install in this session corrupted the parent’s pnpm-lock.yaml (906 lines removed, including the entire sites/cilantro-site importer) — reverted immediately with git checkout -- pnpm-lock.yaml in the parent repo before anything was committed. Added an empty packages: [] pnpm-workspace.yaml to this site, matching the existing convention already used by twf_site, hypernova-site, and mpstaton-site. Verified with pnpm list -r --depth -1 before/after — now correctly shows only fullstack-vc as a workspace member.
• changelog/2026-07-06_01.md schema mismatch. That entry used date_created/date_modified and a list-valued augmented_with, but this site’s src/content.config.ts changelog collection schema requires a coercible date field and a string-typed augmented_with. This broke pnpm build outright (InvalidContentEntryDataError) — confirmed via a baseline comparison that the failure predates this session’s dependency changes. Added a date field and converted augmented_with to a string; left date_created/date_modified in place since the schema is .passthrough().

Verification

• pnpm build — passes cleanly (110+ routes prerendered, server output, Vercel adapter bundled, sitemap generated).
• pnpm exec astro check — 16 pre-existing errors, 0 warnings, 355 hints. Confirmed via a baseline diff (reverting package.json/pnpm-lock.yaml to the pre-upgrade commit, reinstalling, and re-running check) that the error set is byte-for-byte identical before and after this pass — all 16 predate this work and are unrelated to the dependency bumps (React-less TS strictness issues in people/index.astro, stacks/index.astro, slides/*, and a Buffer/BlobPart mismatch in ideogram.ts). Not fixed here per scope.