chore: update node, update deps, add dependabot config. more production readiness

.github/dependabot.yml

@@ -0,0 +1,43 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 10
+    groups:
+      dev-dependencies:
+        dependency-type: development
+        update-types:
+          - patch
+          - minor
+      runtime-patch-minor:
+        dependency-type: production
+        update-types:
+          - patch
+          - minor
+      runtime-major:
+        dependency-type: production
+        update-types:
+          - major
+    labels:
+      - dependencies
+      - automated
+    commit-message:
+      prefix: "chore"
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:15"
+      timezone: "UTC"
+    labels:
+      - dependencies
+      - ci
+    commit-message:
+      prefix: "chore"

.github/workflows/ci.yml

@@ -22,10 +22,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Use Node.js 22
+      - name: Use Node.js from .nvmrc
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version-file: .nvmrc
           cache: npm
 
       - name: Install dependencies

.github/workflows/daily-digest.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "22"
+          node-version-file: .nvmrc
           cache: "npm"
       - name: Install dependencies
         run: npm ci

.nvmrc

@@ -0,0 +1 @@
+24

README.md

@@ -35,9 +35,12 @@ Where the value is delivered.
     ```bash
     git clone <repo-url>
     cd synapse
+    nvm use
     npm install
     ```
 
+    Node.js runtime is pinned in `.nvmrc` and enforced in `package.json` (`engines.node`).
+
 2.  **Configure Environment**
     Copy `.env.example` to `.env` and populate it with your credentials.
     ```bash
@@ -86,6 +89,14 @@ Synapse is configured via environment variables.
 - `npm run discourse:debug`: Validate Discourse connectivity.
 - `npm run models:list`: List available Gemini models.
 
+## Dependency Maintenance
+
+- Node.js runtime is pinned via `.nvmrc`, and CI reads from that file.
+- Automated update PRs are configured in `.github/dependabot.yml`.
+- Review patch/minor updates weekly and schedule major updates intentionally.
+- `package.json` includes npm `overrides` for vulnerable transitive packages (`diff`, `undici`) so security patches can be applied without forcing a breaking direct dependency downgrade.
+- Keep these `overrides` only while upstream trees require them; remove once direct dependency updates naturally resolve to patched transitive versions.
+
 ## Coverage
 
 - Coverage is generated natively in GitHub Actions (`CI - Tests & Coverage`) in report-only mode.

dist/services/llm/AiSdkProcessor.js

@@ -101,11 +101,19 @@ class AiSdkProcessor {
                 maxOutputTokens: this.config.MAX_SUMMARY_TOKENS,
                 temperature: 0.2,
             });
+            const parsed = schemas_1.DigestItemSchema.safeParse(object);
+            if (!parsed.success) {
+                return {
+                    headline: defaultHeadline,
+                    url: defaultUrl,
+                    summary: "Error generating summary."
+                };
+            }
             // Fallback if model hallucinates empty fields, though schema enforces strings.
             return {
-                headline: object.headline || defaultHeadline,
-                url: object.url || defaultUrl,
-                summary: object.summary
+                headline: parsed.data.headline || defaultHeadline,
+                url: parsed.data.url || defaultUrl,
+                summary: parsed.data.summary
             };
         }
         catch (err) {