chore(deps): land the two open Dependabot npm PRs (#147 minor-and-patch, #145 vitest 5) and settle Node 20 in release.yml #149

Why this issue exists

The 2026-10-05 Dependabot sweep (run from Maecenas) merged the GitHub Actions bump (#144) and left the two npm PRs for this repo's own coding agent to land on a branch with tests. Both were fully green on 2026-10-05 (15 of 15 checks, including every required CI job), so this is a short list; the one judgment call is the Node version question at the end.

The two PRs

#147, minor-and-patch

• commitlint 21.2.3 is bug fixes only (among them: trim trailing whitespace before ignore matchers, detect dynamic await support on Node majors above 20, report the matching case in case-rule failures).
• commit-and-tag-version 13.2.0 adds "document and support custom writer render functions" and Maven multi-module support; 13.2.1 "bring back the blank line between release notes sections". That last fix changes how CHANGELOG.md is rendered, so merge chore(deps): bump the minor-and-patch group across 1 directory with 3 updates #147 before the v0.7.0 cut (35 commits since v0.6.0 on 2026-10-05) so the next changelog is produced with the version that will be used from then on. Its engines.node is >=22, unchanged from 13.1.2.

#145, vitest 5

• The repo's own suite (pnpm test, scripts/__tests__/vitest.config.js) runs in the Script Tests job on Node 22, and it passed on the PR. The Node.js 20 Compatibility job only installs and lists packages, so it is unaffected (Nerva has no .npmrc, so pnpm warns rather than fails on the engines mismatch).
• Breaking changes from the release (https://github.com/vitest-dev/vitest/releases/tag/v5.0.0) that can bite a Node script suite: mocks are cleared by default before each test; a test fails when an asynchronous assertion is not awaited; expect.poll fails when the function does not resolve in time; hoistable methods must be at the top level; the sequential test/suite option was removed in favor of concurrent; the config file is no longer looked up in ancestor directories (this repo passes --config explicitly, so fine); test.for/test.each titles no longer quote $ string values. Migration guide: https://vitest.dev/guide/migration
• templates/ do not pin a vitest version, so generated projects are not affected; only developing Nerva itself now needs Node 22+.

Follow-up to decide: Node 20 in this repo

• .github/workflows/release.yml runs pnpm release on Node 20 while commit-and-tag-version 13.x declares engines.node >=22 (true since 13.1.2). pnpm only warns because there is no engine-strict, and the May 2026 release runs succeeded, but the mismatch should be closed by moving release.yml to Node 22 before the v0.7.0 cut.
• Node 20 left support on 2026-04-30 (https://nodejs.org/en/about/previous-releases). Decide whether the Node.js 20 Compatibility matrix entry stays (it guards generated projects, which the vitest bump does not touch) and update docs/onboarding/troubleshooting.md, which says "Nerva requires Node.js 20 or later", to state Node 22 for developing Nerva.

Verification

pnpm install --frozen-lockfile
pnpm test
pnpm verify:ci

One conventional, lowercase squash subject per PR (Dependabot's titles here are already lowercase, so pnpm exec commitlint passes as is).

Sweep log (GitHub Actions bumps, merged from Maecenas)

• 2026-10-05: ci(deps): bump actions/setup-node from 6 to 7 #144 actions/setup-node 6 to 7 merged as 57b39a9 (the last @v6 reference in ci.yml; release.yml was already on v7).
• 2026-10-05, later: the first CI run on main after that merge lost eight jobs to a GitHub Actions runner incident (https://stspg.io/c11dc9nb1zdq); the re-run passed all twelve jobs. chore(deps): bump vitest from 4.1.11 to 5.0.3 #145 and chore(deps): bump the minor-and-patch group across 1 directory with 3 updates #147 were updated onto the new main (Paul, by hand) and re-run after the same incident cancelled some of their jobs; both are CLEAN (15 of 15) as of 21:33 UTC. Note that those two branches now carry a manual merge commit, so a future @dependabot rebase will be refused; use @dependabot recreate or merge them as they are.

Related: #130 and #132 (enabling Dependabot and the sweep rotation).

Filed by Claude for Paul from the Maecenas dependency sweep task of 2026-10-05.