fix(docs): unbreak docs deploy on node 24 + resync lockfile [4.x]

[ManukMinasyan]

Problem

The Deploy Docs workflow has been failing since 2026-05-19 (last green deploy: 2026-05-12). It dies at the npm ci step in docs/:

npm error code EUSAGE
npm error `npm ci` can only install packages when your package.json and
          package-lock.json ... are in sync.
npm error Missing: commander@13.1.0 from lock file

Failing run: https://github.com/relaticle/flowforge/actions/runs/28388314274/job/84108617614

Root cause (reproduced locally)

@bomb.sh/tab — pulled in transitively via docus → @nuxt/cli — declares an optional peer dependency commander@^13.1.0 (peerDependenciesMeta.commander.optional = true; it works with cac/citty/commander, and @nuxt/cli uses citty).

npm ≤ 10.9.x (the version bundled with the workflow's Node 20) npm install correctly skips the optional peer, but npm ci on the same npm wrongly demands it and rejects the lockfile. Regenerating the lock with npm 10 does not fix it — npm ci then fails with Invalid: lock file's commander@7.2.0 does not satisfy commander@13.1.0. npm 11 (bundled with Node 24) resolves install and ci consistently.

Two secondary issues compounded it:

• "docus": "latest" — a floating dist-tag makes the docs dependency tree non-deterministic and lets the committed lockfile drift out of sync. Dependabot also can't govern a latest tag.
• Node 20 is below the stack's engines — @nuxt/nitro-server@4.4.8 etc. require node ^22.12.0 || ^24.11.0 || >=26.0.0 (the EBADENGINE warnings in the log). Even with the lock fixed, Node 20 was on borrowed time.

Fix

Change	Why
deploy-docs.yml: Node 20 → 24	24 ships npm 11 (fixes the optional-peer npm ci bug) and satisfies the packages' engines. One bump, both problems.
docs/package.json: docus: latest → ^5.12.3 + add engines.node >= 22.12.0	Kills the floating dist-tag → reproducible tree, and makes docus Dependabot-manageable.
docs/package-lock.json: regenerated with npm 11	Back in sync with the manifest.
.github/dependabot.yml: add npm ecosystem at /docs	Docs deps now get controlled, CI-verified bump PRs instead of silently drifting.
docs/.nvmrc: 24	Local dev matches CI.

Verification

Reproduced the original failure on the checked-out commit, then verified the fix on the regenerated lockfile:

• npm ci (npm 11) → exit 0, added 1291 packages
• npm run generate (the workflow's build step, with the CI env vars) → Build complete!, 47 routes prerendered, .output/public/index.html written (172 files)

[Copilot]

Pull request overview

Fixes the broken documentation deployment by aligning the docs toolchain and CI with a Node/npm combination that can successfully run npm ci, and by making the docs dependency tree deterministic and Dependabot-managed.

Changes:

• Bump the Deploy Docs workflow to Node 24 (npm 11) to avoid the optional-peer/npm ci lockfile enforcement mismatch and satisfy modern package engines.
• Pin docus to a semver range and add a minimum Node engine for the docs project.
• Add Dependabot updates for /docs and align local docs dev Node version via docs/.nvmrc.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
docs/package.json	Pins docus and adds a Node engine floor for deterministic, compatible installs.
docs/.nvmrc	Aligns local docs development Node version with CI expectations.
.github/workflows/deploy-docs.yml	Updates the docs deploy workflow to run on Node 24 (npm 11).
.github/dependabot.yml	Enables Dependabot updates for docs npm dependencies (and schedules GitHub Actions updates).
docs/package-lock.json	Resynced lockfile to match the updated docs manifest and npm 11 resolution.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.