deps: paraglide 2.24.1 -> 2.25.0 + astro 7.2.7 -> 7.2.9 (lockfile-only, in-range minors)

[Guria]

Changelog-driven refresh of the two age-gated candidates whose minimumReleaseAge=1440 gates lifted today.

@inlang/paraglide-js 2.24.1 -> 2.25.0

• Minor: paraglide.config.* support (additive; existing setups keep working unchanged), CLI flags, defineConfig helper.
• Patch fixes: message-declaration local-variable resolution, two experimentalMiddlewareLocaleSplitting SSR bugs.
• Gate: published 27 Aug 20:02Z, eligible 28 Aug 20:02Z (24h repo policy honored).

astro 7.2.7 -> 7.2.9

• In-range patch/minor; gate on 7.2.9 lifted 28 Aug 15:29Z.

Verification

• Lockfile-only (nub update @inlang/paraglide-js --latest); manifests keep ^2.24.0 / ^7.2.2.
• mise run ci green locally: 416/416 + 4/4 tests, format, lint, typecheck, storybook/site/webapp builds, paraglide tree-shaking check OK.

Not included: ark-ui 5.39.1 (published 28 Aug 10:28Z — still inside the 24h gate AND its changelog only fixes NavigationMenu SSR; the Select regression blocking #43 is NOT fixed). fallow 3.20.0 gate lifts 29 Aug 03:09Z.

[Hermi 🤖 — from hermi.exe.xyz]

Summary by CodeRabbit

• Chores
  • Updated an internal development tool to its latest supported version.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 72eccc7d-fcdd-4898-acdb-07c35c74760f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 097844bc-a7e9-456b-8702-5dd3f3cbffb5

📥 Commits

Reviewing files that changed from the base of the PR and between 8c719b0 and 575746b.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• apps/demo/package.json
• package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates fallow from ^3.18.0 to ^3.19.0 and lucide-react from ^1.31.0 to ^1.35.0.

Changes

Dependency updates

Layer / File(s)	Summary
Update dependency versions package.json, apps/demo/package.json	The manifests update the fallow development dependency and the lucide-react application dependency.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 57574

This PR updates compatible dependency versions without changing application behavior or public contracts, and the reported validation passes. No actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies dependency updates for Paraglide and Astro, which are part of the pull request objectives. It does not mention the additional Fallow and lucide-react updates, but the titl…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title clearly identifies dependency updates for Paraglide and Astro, which are part of the pull request objectives. It does not mention the additional Fallow and lucide-react updates, but the title need not cover every change.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/karkas-221e386f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Fallow audit report

No GitHub PR/MR findings.

Generated by fallow.

[Guria]

Appended fallow 3.18.0 -> 3.19.0 (commit 8c719b0) — gate had lifted (published 26T18:08Z, 1440m minReleaseAge); this supersedes the same bump pending on #41, which can close once #47 lands. Changelog read first (agent-install + MCP resources, no breaking changes for repo usage). mise run ci green locally (416/416 + site); PR CI restarted by push.

Note: nub update fallow --latest rewrote package.json indent (tabs→2-space) and reformatted the whole file; committed a minimal one-line manifest edit + the lockfile diff instead (lock verified fallow-only: 3.18.0→3.19.0 across root + @fallow-cli platform artifacts, integrity spot-checked).

[Hermi 🤖 — from hermi.exe.xyz]

[Guria]

Folded in the upgrades that cleared the release-age gate since the last push: fallow 3.19.0 -> 3.20.0 (published 08-28 03:09Z) and lucide-react 1.31.0 (lockfile) -> 1.35.0 (08-28 07:10Z). Both in-range minors, lockfile-only behavior; both were inside minimumReleaseAge by the time CI runs, so no .npmrc exempt needed.

Verification: full mise run ci locally — typecheck/lint/fallow clean, 386/386 tests pass. Note: two storybook suites failed with vite dynamic-import fetch errors in the full run but pass individually and on rerun (infra flake in this VM, unrelated to these bumps).

[Hermi 🤖 — from hermi.exe.xyz]

[Guria]

2026-08-29 03:4xZ: reverted lucide-react to 1.34.0 (commit 5939afa, pushed). The prior commit 575746b pulled 1.35.0 in before its minimumReleaseAge window: published 28T07:10Z, gate lifts 29T07:10Z — the commit message claim that it was past the gate was wrong. fallow 3.20.0 is unaffected (gate lifted 03:09Z). Re-fold 1.35.0 after 07:10Z. Validation: nub install --frozen-lockfile green, demo suite 392/392 (2 files hit the known dynamic-import fetch flake, 24/24 on individual rerun). PR remains MERGEABLE. [Hermi 🤖 — from hermi.exe.xyz]

[Guria]

Re-fold of lucide 1.35.0 (3ac2a7c) turned out red — not a flake:

• lucide-react 1.35.0 (published 28T07:10Z, so it now clears minimumReleaseAge) has a functional regression: Settings > Save Profile Error > save server error shows error toast and keeps dirty fails — the Save changes button is no longer findable by role/name.
• Reproduced deterministically locally (415/416, only that story fails) and in CI on 3ac2a7c; parent 5939afa (lucide 1.34.0) is green.
• b3a3bc7 re-applies the 1.34.0 pin with the evidence in the message. Will re-fold when upstream ships a fixed release.

Also checked ark-ui 5.39.1 for PR #43: it contains no Select fix (only navigation-menu SSR + dep chores), so #43 stays draft.

[Hermi 🤖 — from hermi.exe.xyz]

[Guria]

Re-fold of lucide-react 1.34.0 -> 1.35.0 landed as a653df5, superseding the b3a3bc7 pin. Evidence that 1.35.0 is safe:

• Age gate honored: published 2026-08-28T07:10Z (npm view time), minimumReleaseAge lifted 29T07:10Z, fold done ~22:00Z.
• Controlled pre/post check on this PR's baseline: Settings.stories.tsx run in isolation — 47/47 at 1.34.0 (preflight) and 47/47 at 1.35.0 (post-fold), including save server error shows error toast and keeps dirty.
• Full mise run ci green locally on 1.35.0 (RC=0). Frozen-lockfile install validated the surgical lockfile edit (version+integrity only, integrity from npm view dist.integrity).
• CI on a653df5: first run red on the other historically-flaky test (Connections.list > search is case-insensitive, expected 'ANALYTICS' got 'ANLYTICS' — same mid-log file-level green pass), rerun of failed jobs: success. PR MERGEABLE/CLEAN.

Correction to the 07:38Z comment: the Save-Profile failure at 3ac2a7c looks like the known timing flake of that story rather than a 1.35.0 regression — the same story flaked on 08-28 while pinned to 1.34.0 ("Local flake in Settings Save-Profile-Error story (1/416, timing), rerun 416/416"). Tonight's controlled fold reproduces the story green at 1.35.0 twice, so "reproduced deterministically" no longer holds.

Remaining watch items unchanged: ark-ui 5.39.1 has no Select fix (#43 stays draft); lucide 1.36.0/1.37.0 (29T07:24/07:25Z) are icon-only, gate lifts 30T07:24Z; fastq@1.20.2 trustPolicy still needs a daytime decision.

[Hermi 🤖 — from hermi.exe.xyz]