Updating packages

@drawnagency packages follow a 0.1.x version range. Client sites use "^0.1.0" in package.json, which under semver 0.x rules means >=0.1.0 <0.2.0 — only patch releases are in range; a jump to 0.2.0 would require a manual update.

Being in range is not the same as being installed. Netlify installs with a frozen lockfile, so the committed pnpm-lock.yaml is what actually ships: a newer in-range version reaches a live site only once that lockfile is updated and pushed. Something has to do that — Renovate, or you.

Renovate: what it is configured to do

Client sites ship with renovate.json pre-configured. It is deliberately scoped to @drawnagency/* only — a wildcard rule disables every package, and a second rule re-enables ours. Third-party dependency upgrades (Astro, React, Tailwind, Zod…) are manual, by operator decision. lockFileMaintenance is off too.

For @drawnagency packages the configured behavior is:

• rangeStrategy: "bump" — Renovate bumps the version floor in package.json (e.g. ^0.1.4 → ^0.1.5) rather than leaving a range that could be satisfied by a stale version.
• minimumReleaseAge: "3 days" — Renovate waits three days after a new version is published before opening the PR, providing a buffer to catch and retract a bad publish before it reaches client sites.
• automerge: true (squash) — Renovate merges its own PR without human review.

What is actually true in production today

Two things make the description above aspirational rather than operative. Read them before relying on it.

• Renovate has never opened a PR on any client repo. The GitHub App is installed org-wide and every repo’s config is correct, but the Mend organization’s Dependency Updates (Renovate) engine is set to Silent — it runs on schedule and suppresses all output, so there are no PRs and not even a Dependency Dashboard issue. Until that setting is flipped to Enabled at developer.mend.io, no update reaches any client site automatically. In the meantime every release ships by hand (below).
• There is no CI to gate the automerge on. Client repos have no .github/workflows and no branch protection, so when Renovate is un-silenced, automerge: true will merge straight to main and trigger a production Netlify deploy with nothing having verified the build. minimumReleaseAge: "3 days" is the only safeguard — it is a delay, not a check. (The framework’s own scripts/publish.sh runs the full test suite before anything reaches npm, which is why this posture was accepted; but nothing re-verifies the client build.) Expect a burst of PRs on the first non-silent run, too.

There is also no automated vulnerability signal on these repos: osvVulnerabilityAlerts and vulnerabilityAlerts are both disabled in renovate.json. That is deliberate — security alerts bypass packageRules in Renovate, so leaving them on would have raised third-party CVE PRs in defiance of the @drawnagency-only scoping. It is a recorded, accepted risk; the intended compensating control is GitHub Dependabot alerts (alerts only, no PRs). Do not re-enable those keys without re-reading the description block at the top of renovate.json.

Forcing an immediate update

Because nothing lands unattended today, this is the path that actually ships a release to a live site.

To update @drawnagency packages right now, run from the client repo root:

pnpm update "@drawnagency/*"
git add package.json pnpm-lock.yaml
git commit -m "chore: update @drawnagency packages"
git push

Netlify picks up the push and deploys the updated site.

Rolling the whole fleet at once

For a release that has to reach every client site, the framework monorepo ships scripts/bump-client-sites.mjs. It discovers the portal repos in the org, then per repo: shallow-clones, runs pnpm update "@drawnagency/*" (rewriting package.json and pnpm-lock.yaml together), builds as a gate, commits both files, and pushes — which is what triggers each Netlify deploy. It refuses to touch anything unless you pass --yes; --dry-run resolves and reports without writing. --repos / --exclude narrow the set, and --no-build skips the build gate.

node scripts/bump-client-sites.mjs --dry-run
node scripts/bump-client-sites.mjs --yes

It only ever modifies package.json and pnpm-lock.yaml, and skips any repo whose diff contains anything else.

Always commit the lockfile

Netlify installs with a frozen lockfile. The committed pnpm-lock.yaml is the exact set of packages that will be installed — if you update package.json without updating and committing pnpm-lock.yaml, the Netlify build will fail with a lockfile mismatch error.

Always commit package.json and pnpm-lock.yaml together.

Version range rules

The ^0.1.0 range will not pick up a 0.2.0 or later release. If a future breaking change requires moving to 0.2.x, update the range in package.json manually:

{
  "dependencies": {
    "@drawnagency/core": "^0.2.0",
    "@drawnagency/primitives": "^0.2.0"
  }
}

Then run pnpm install and commit both files. Check the release notes for migration steps before updating across a minor-version boundary.