… taken, 1 corrected, 3 held) (#315)

## EPICON Intent Block

- **Intent:** Consolidate the five open Dependabot PRs (#310–#314) into
one reviewable change with per-dependency judgment, per operator request
("check if they are safe to merge, if not, unify them to one big PR for
safety").
- **Scope:** `package-lock.json`, three workspace `package.json` files,
`.github/dependabot.yml` ignore rules. No workflow, canon, or attested
content touched.
- **Actor:** Claude Code under operator identity, C-339.
- **Consequence class:** Dependency hygiene — net reduction of
unreviewed major-version churn.

## Safety verdict per PR

| PR | Bump | Verdict | Disposition |
|---|---|---|---|
| #310 | `@vercel/node` 5.8.16→5.8.17 | ✅ Safe (patch, in-range of
`^5.5.15`) | **Taken** — lockfile updated |
| #312 | `@types/node` 18→**25** | ⚠️ Wrong target — repo runtime is
**Node 20** | **Taken as 18→20**: `^18.0.0`→`^20.0.0` in
`packages/atlas-sentinel`, `sentinels/atlas`, `sentinels/uriel`;
lockfile dedupes to one 20.x. Ignore rule for `@types/node >=21` |
| #311 | `hardhat-chai-matchers` 2→3 | ❌ Incompatible — requires hardhat
3; `gic-registry-contracts` pins `hardhat 2.22.5` | **Held** via ignore
rule; bump belongs in a hardhat-3 migration |
| #313 | `http-proxy-middleware` 2→4 | ❌ Two majors; v3 rewrote the
`createProxyMiddleware` API that `apps/api-gateway` uses | **Held** via
ignore rule |
| #314 | `tailwindcss` 3→4 | ❌ v4 is a CSS-first config rewrite; **8
apps** pin `^3.4.x` with `tailwind.config.js` | **Held** via ignore
rule; migrate deliberately, not via dep bump |

The ignore rules follow the repo's own precedent (#308, ESLint held at
8.x), each with a comment stating the unblock condition so they're
revisitable, not permanent.

## Lockfile diff verification

Verified the lock diff contains **only**: `@vercel/node` 5.8.16→5.8.17,
removal of nested `@types/node` 18.19.130 copies (dedupe to root
20.19.43), in-range nested 22.19.1→22.19.21 refreshes, and the
`undici-types` transitive. No major versions moved.

## After merge

Dependabot auto-closes #310–#314 on its next run: #310/#312 because the
dependencies moved, #311/#313/#314 because of the ignore rules. No
manual closing needed.

**Residual risk:** the three packages whose types moved 18→20 are
type-checked in CI, not locally (worktree had no `node_modules`) — if
CI's type-check flags anything, I'll fix on this branch.

https://claude.ai/code/session_014WMkjWLnt4ezGEHujmukLk

---
_Generated by [Claude
Code](https://claude.ai/code/session_014WMkjWLnt4ezGEHujmukLk)_