👷 consolidate safe Renovate updates

[kikoveiga]

Consolidates the Renovate backlog: takes the two updates that are safe today, and stops the two that aren't from being reproposed every weekend.

Open PRs handled

PR	Action
#162 all non-major bumps	✅ taken — red CI fixed, see below
#184 actions/setup-node v7	✅ taken as-is, supersedes the v6.5.0 bump in #162
#164 vite 8	❌ close — electron-vite@5.0.0 declares a peer range of ^5 || ^6 || ^7, so vite 8 can't work in that app. Renovate now pins it to <8
#165 lock file maintenance	❌ close — the root yarn.lock half couldn't be generated at all, and the rest was ~40 untested Rust crate bumps. Renovate now keeps Cargo.lock out of lock file maintenance

Not touched, still open: #171 (dd-trace v6, runtime major — needs its own PR) and #123 (typescript v6, contains hand-written migration work and is superseded by TS 7).

Why #162 was red, and what changed

Two failing jobs, one cause: prettier 3.9 collapses union types and empty object types that previously wrapped. format failed directly, and lint failed because eslint.config.mjs pulls in eslint-plugin-prettier/recommended. Fixed with yarn format — 5 files, pure formatter output, no logic changes. eslint 10.7 / typescript-eslint 8.64 report nothing new beyond that.

Lockfiles were regenerated against current main rather than reusing Renovate's stale artifacts. That also keeps playground/yarn.lock and e2e/app/yarn.lock in sync: both consume the SDK via portal:, so any root dependency change invalidates them and CI's immutable install fails. That is the actual reason #171's CI is red — not a dd-trace v6 incompatibility.

Review notes

• dd-trace 5.109.0 → 5.115.0 is the only production dependency in this PR. Everything else is devDeps, CI, packageManager/volta, and lockfiles.
• The two generated *.types.ts files are safe to reformat: scripts/generate-schema-types.ts runs prettier --write on its own output, so regeneration matches.
• publish.yml only runs on workflow_dispatch, so CI never exercises the setup-node bump. Worth a dry_run: true run of the publish workflow before the next release.

Verified locally

yarn install --immutable × 3 (root, playground, e2e/app) · format:check · eslint --max-warnings 0 · typecheck · build · check-package-content · check-licenses · unit tests (45 files, 777 tests) · e2e app + playground builds — all pass.

Not run locally: the Playwright e2e/integration suites (need Electron + xvfb); both were already green on #162.

Known issue this does not fix

Renovate can't regenerate the root yarn.lock at all — the bcaudan/json-schema-to-typescript fork is blocked by yarn's approvedGitRepositories in Renovate's sandbox, so every lockFileMaintenance run will be partial. Not fixable in renovate.json; needs either a Renovate-side allowlist or replacing the fork with a patch: dep on the published package.

🤖 Generated with Claude Code