chore(deps): in-range refresh, Astro 7 docs, bun 1.4.2 pin, hold chat-react

.changeset/deps-refresh-2026-09.md

@@ -0,0 +1,15 @@
+---
+"@workkit/approval": patch
+"@workkit/mcp": patch
+"@workkit/mail": patch
+---
+
+chore(deps): raise runtime dependency floors to current in-range releases
+
+- `@workkit/approval`, `@workkit/mcp`: `hono` `^4.7.10` → `^4.13.11`
+- `@workkit/mail`: `mimetext` `^3.0.24` → `^3.0.28`, `postal-mime` `^2.4.1` → `^2.7.6`
+
+Same major versions; no API changes. The `hono` floor moves past the
+4.12.x advisories (CORS credential reflection, `bodyLimit` bypass, cache
+`Vary` leakage, `parseBody` nesting DoS, and others fixed through 4.13.5),
+so consumers resolving an older 4.x get a patched copy.

.github/dependabot.yml

@@ -37,18 +37,11 @@ updates:
         update-types:
           - patch
           - minor
-    ignore:
-      # Astro majors are blocked on the Starlight/Tailwind coordinated
-      # migration tracked in #115. Remove this entry once that migration
-      # lands so Dependabot can resume bumping astro majors.
-      - dependency-name: astro
-        update-types:
-          - version-update:semver-major
 
   # Bun workspace root — resolves the transitive graph for every
   # packages/*, integrations/*, tooling/*, and apps/* manifest via the
   # shared root `bun.lock`. Root `package.json` declares
-  # `"packageManager": "bun@1.3.8"` and the only lockfile in the repo is
+  # `"packageManager": "bun@1.4.2"` and the only lockfile in the repo is
   # `bun.lock`, so the root entry uses `package-ecosystem: bun` (GA'd
   # 2025-02, distinct from the `npm` ecosystem which covers npm/yarn/pnpm
   # manifests only). The /apps/docs entry above stays on `npm` because

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.8"
+          bun-version: "1.4.2"
       - run: bun install --frozen-lockfile
       - run: bun run lint
 
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.8"
+          bun-version: "1.4.2"
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
 
@@ -42,7 +42,7 @@ jobs:
           fetch-depth: 0
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.8"
+          bun-version: "1.4.2"
       - run: bun install --frozen-lockfile
       - name: Run constitution checks (diff-only against base)
         env:
@@ -68,7 +68,7 @@ jobs:
           node-version: ${{ matrix.node-version }}
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.8"
+          bun-version: "1.4.2"
       - run: bun install --frozen-lockfile
       - run: bun run build
       - run: bun run test
@@ -80,7 +80,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.8"
+          bun-version: "1.4.2"
       - run: bun install --frozen-lockfile
       - run: bun run build
       - name: Check bundle sizes

.github/workflows/deploy-docs.yml

@@ -25,7 +25,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.4.2"
 
       - name: Install dependencies
         run: bun install

.github/workflows/maina-ci.yml

@@ -9,6 +9,8 @@ jobs:
         with:
           node-version: 22
       - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.4.2"
       - run: bun install
       - run: bun run lint
       - run: bun run typecheck

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
           node-version: 22
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.8"
+          bun-version: "1.4.2"
       - run: bun install --frozen-lockfile
       - run: bun run build
       - run: bun run test

.github/workflows/size-report.yml

@@ -16,7 +16,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.8"
+          bun-version: "1.4.2"
 
       - name: Install & build PR
         run: |

.maina/constitution.md

@@ -10,7 +10,7 @@ Non-negotiable rules. Injected into every AI call. Mechanical checks live in `sc
 - Test: vitest (via `turbo test`)
 - Build: bunup (per-package), turbo (orchestrator)
 - Monorepo: yes (bun workspaces)
-- Package manager: bun@1.3.8
+- Package manager: bun@1.4.2
 
 ## Architecture
 

apps/docs/astro.config.mjs

@@ -1,7 +1,7 @@
 import { defineConfig } from 'astro/config';
 import starlight from '@astrojs/starlight';
-import tailwind from '@astrojs/tailwind';
 import react from '@astrojs/react';
+import tailwindcss from '@tailwindcss/vite';
 
 export default defineConfig({
   site: 'https://beeeku.github.io',
@@ -23,7 +23,7 @@ export default defineConfig({
         },
         {
           label: 'Guides',
-          autogenerate: { directory: 'guides' },
+          items: [{ autogenerate: { directory: 'guides' } }],
         },
         {
           label: 'Reference',
@@ -36,7 +36,9 @@ export default defineConfig({
       ],
       customCss: ['./src/styles/global.css'],
     }),
-    tailwind({ applyBaseStyles: false }),
     react(),
   ],
+  vite: {
+    plugins: [tailwindcss()],
+  },
 });

apps/docs/package.json

@@ -12,20 +12,20 @@
     "deploy:preview": "astro build && wrangler pages deploy dist --branch preview"
   },
   "dependencies": {
-    "@astrojs/react": "^4.2.0",
-    "@astrojs/starlight": "^0.33.0",
-    "@astrojs/starlight-tailwind": "^3.0.0",
-    "@astrojs/tailwind": "^6.0.0",
-    "astro": "^5.7.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "tailwindcss": "^3.4.0",
+    "@astrojs/react": "^7.0.0",
+    "@astrojs/starlight": "^0.42.4",
+    "@astrojs/starlight-tailwind": "^5.0.0",
+    "@tailwindcss/vite": "^4.3.3",
+    "astro": "^7.2.10",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "tailwindcss": "^4.3.3",
     "zod": "3.25.76"
   },
   "devDependencies": {
-    "@astrojs/check": "^0.9.0",
-    "@types/react": "^19.0.0",
-    "@types/react-dom": "^19.0.0",
-    "wrangler": "^4.76.0"
+    "@astrojs/check": "^0.9.10",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "wrangler": "^4.143.0"
   }
 }

apps/docs/src/components/Landing.tsx

@@ -49,7 +49,7 @@ export default function Landing() {
 				</div>
 
 				<h1 className="text-5xl md:text-6xl font-extrabold tracking-tight leading-tight">
-					<span className="bg-gradient-to-r from-sky-400 via-cyan-300 to-teal-400 bg-clip-text text-transparent">
+					<span className="bg-linear-to-r from-sky-400 via-cyan-300 to-teal-400 bg-clip-text text-transparent">
 						Composable utilities
 					</span>
 					<br />

apps/docs/src/styles/global.css

@@ -1,6 +1,8 @@
-@import 'tailwindcss/base';
-@import 'tailwindcss/components';
-@import 'tailwindcss/utilities';
+@layer base, starlight, theme, components, utilities;
+
+@import '@astrojs/starlight-tailwind';
+@import 'tailwindcss/theme.css' layer(theme);
+@import 'tailwindcss/utilities.css' layer(utilities);
 
 :root {
   --sl-color-accent-low: #1e1b4b;