fg-devkit 1.12.14 → 1.14.3

package/README.md

@@ -102,7 +102,7 @@ Check vulnerabilities for all policy packages together (including transitive dep
 pnpm exec fgd policy-vulns
 ```
 
-Check vulnerabilities for all dependencies in the current repo:
+Check vulnerabilities for all dependencies in the current repo (and nested packages with their own `pnpm-lock.yaml`):
 
 ```bash
 pnpm exec fgd repo-vulns
@@ -126,7 +126,8 @@ If npm audit is rate-limited (429), slow the scan down:
 pnpm exec fgd fleet-vulns --delay-ms=8000
 ```
 
-Upgrade policy versions interactively:
+Upgrade policy versions interactively and auto-commit
+(`dep(package): bump to version`, or `dep(): bump N packages` with a body listing each bump):
 
 ```bash
 pnpm exec fgd policy-upgrade
@@ -138,13 +139,15 @@ Sync dependency policy, run pnpm install, and auto-commit (`chore(repo): sync de
 pnpm exec fgd sync-deps-commit
 ```
 
-Upgrade one package.json dependency and auto-commit (`dep(package): bump to version`):
+Upgrade one or more package.json dependencies and auto-commit
+(`dep(package): bump to version`, or `dep(): bump N packages` with a body listing each bump):
 
 ```bash
 pnpm exec fgd policy-upgrade-commit
 ```
 
-Fix one vulnerability override interactively and auto-commit (`vuln(package): override version`):
+Fix one or more vulnerability overrides interactively and auto-commit
+(`vuln(package): override version`, or `vuln(): override N packages` with a body listing each change):
 
 ```bash
 pnpm exec fgd audit-override-commit

package/configs/cliff.toml

@@ -5,7 +5,7 @@
 [changelog]
 body = """
 {% if version %}\
-    ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d %H:%M") }}
+    ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
 {% else %}\
     ## [unreleased]
 {% endif %}\

package/configs/cliff.user.toml

@@ -5,7 +5,7 @@
 [changelog]
 body = """
 {% if version %}\
-## Version {{ version | trim_start_matches(pat="v") }} - {{ timestamp | date(format="%Y-%m-%d %H:%M") }}
+## Version {{ version | trim_start_matches(pat="v") }} - {{ timestamp | date(format="%Y-%m-%d") }}
 {% else %}\
 ## [unreleased]
 {% endif %}\

package/configs/dependency-policy.vue-workspace.json

@@ -1,6 +1,6 @@
 {
   "toolchain": {
-    "packageManager": "pnpm@11.20.0",
+    "packageManager": "pnpm@11.21.0",
     "node": {
       "nvmrc": "22",
       "engines": ">=22.13.0",
@@ -10,16 +10,17 @@
   },
   "managedDependencies": {
     "dependencies": {
+      "@e965/xlsx": "0.20.3",
       "@element-plus/icons-vue": "2.3.2",
       "@lexical/html": "0.49.0",
       "@lexical/list": "0.49.0",
       "@lexical/rich-text": "0.49.0",
+      "@lexical/link": "0.49.0",
       "@piwikpro/vue-piwik-pro": "1.7.1",
-      "@sentry/browser": "10.69.0",
+      "@sentry/browser": "10.70.0",
       "@sentry/tracing": "7.120.4",
-      "@sentry/vue": "10.69.0",
-      "@sentry/wasm": "10.69.0",
-      "@tailwindcss/postcss": "4.3.3",
+      "@sentry/vue": "10.70.0",
+      "@sentry/wasm": "10.70.0",
       "@tanstack/vue-query": "5.101.4",
       "@types/leaflet": "1.9.22",
       "@unhead/vue": "2.0.5",
@@ -31,7 +32,7 @@
       "chart.js": "4.5.1",
       "content-disposition-header": "0.6.0",
       "date-fns": "4.4.0",
-      "element-plus": "2.14.3",
+      "element-plus": "2.14.4",
       "fds-vue-core": "8.4.3",
       "imask": "7.6.1",
       "leaflet": "1.9.4",
@@ -60,11 +61,11 @@
       "@eslint/js": "9.39.1",
       "@intlify/unplugin-vue-i18n": "11.2.4",
       "@playwright/test": "1.62.1",
-      "@storybook/addon-a11y": "10.5.6",
-      "@storybook/addon-docs": "10.5.6",
-      "@storybook/addon-vitest": "10.5.6",
-      "@storybook/vue3": "10.5.6",
-      "@storybook/vue3-vite": "10.5.6",
+      "@storybook/addon-a11y": "10.5.7",
+      "@storybook/addon-docs": "10.5.7",
+      "@storybook/addon-vitest": "10.5.7",
+      "@storybook/vue3": "10.5.7",
+      "@storybook/vue3-vite": "10.5.7",
       "@tanstack/vue-query-devtools": "6.1.38",
       "@tsconfig/node22": "22.0.5",
       "@types/lodash-es": "4.17.12",
@@ -76,13 +77,12 @@
       "@vue/test-utils": "2.4.11",
       "arg": "5.0.2",
       "babel-eslint": "10.1.0",
-      "eslint-plugin-storybook": "10.5.6",
+      "eslint-plugin-storybook": "10.5.7",
       "globals": "15.11.0",
       "jsdom": "26.1.0",
-      "postcss": "8.5.26",
       "sass": "1.102.0",
-      "storybook": "10.5.6",
-      "tsx": "4.23.9",
+      "storybook": "10.5.7",
+      "tsx": "4.23.12",
       "vega": "6.3.1",
       "vite-plugin-dts": "4.5.4",
       "vite-plugin-vue-devtools": "8.2.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.12.14",
+  "version": "1.14.3",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -107,13 +107,13 @@
     "@inquirer/input": "5.1.2",
     "@inquirer/select": "5.2.1",
     "@intlify/eslint-plugin-vue-i18n": "4.5.1",
-    "@typescript-eslint/eslint-plugin": "8.66.0",
-    "@typescript-eslint/parser": "8.66.0",
-    "@vitest/eslint-plugin": "1.6.26",
+    "@typescript-eslint/eslint-plugin": "8.67.0",
+    "@typescript-eslint/parser": "8.67.0",
+    "@vitest/eslint-plugin": "1.6.27",
     "@vue/eslint-config-prettier": "10.2.0",
     "@vue/eslint-config-typescript": "14.9.0",
     "@vue/tsconfig": "0.9.1",
-    "eslint": "10.8.0",
+    "eslint": "10.8.1",
     "eslint-plugin-prettier": "5.5.6",
     "eslint-plugin-vue": "10.10.0",
     "fallow": "2.101.0",
@@ -121,13 +121,19 @@
     "lefthook": "2.1.10",
     "npm-check-updates": "22.2.7",
     "prettier": "3.9.6",
-    "tsx": "4.23.9",
+    "tsx": "4.23.12",
     "typescript": "5.9.3",
     "vue-eslint-parser": "10.4.1",
     "vue-tsc": "3.3.9"
   },
   "devDependencies": {
-    "cz-git": "1.13.1",
-    "czg": "1.13.1"
+    "cz-git": "1.13.2",
+    "czg": "1.13.2"
+  },
+  "scripts": {
+    "maintainer-ui": "pnpm --dir electron/maintainer-ui start",
+    "maintainer-ui:install": "pnpm --dir electron/maintainer-ui install",
+    "fgd-ui": "pnpm --dir electron/maintainer-ui start",
+    "fgd-ui:install": "pnpm --dir electron/maintainer-ui install"
   }
 }

package/release-notes/format.ts

@@ -1,22 +1,18 @@
 import type { ChangelogRelease } from './types'
 
+export const toChangelogDateOnly = (date: string): string => {
+  const dateMatch = date.match(/^(\d{4}-\d{2}-\d{2})(?: \d{2}:\d{2})?$/)
+  return dateMatch?.[1] ?? date
+}
+
 export const formatChangelogDate = (date: string): string => {
-  const dateTimeMatch = date.match(/^(\d{4}-\d{2}-\d{2})(?: (\d{2}:\d{2}))?$/)
-  if (!dateTimeMatch?.[1]) {
+  const datePart = toChangelogDateOnly(date)
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(datePart)) {
     return date
   }
 
-  const datePart = dateTimeMatch[1]
-  const timePart = dateTimeMatch[2]
-  const parsed = timePart ? new Date(`${datePart}T${timePart}:00`) : new Date(`${datePart}T12:00:00`)
-  const formattedDate = parsed.toLocaleDateString('sv-SE', { dateStyle: 'long' })
-
-  if (!timePart) {
-    return formattedDate
-  }
-
-  const formattedTime = parsed.toLocaleTimeString('sv-SE', { hour: '2-digit', minute: '2-digit' })
-  return `${formattedDate} ${formattedTime}`
+  const parsed = new Date(`${datePart}T12:00:00`)
+  return parsed.toLocaleDateString('sv-SE', { dateStyle: 'long' })
 }
 
 const CONVENTIONAL_COMMIT_RE = /^(feat|fix|perf|refactor|chore|dep|vuln)(\([^)]+\))?:\s/

package/release-notes/serializeUserChangelog.ts

@@ -1,8 +1,11 @@
-import { sortUserReleaseSections } from './format'
+import { sortUserReleaseSections, toChangelogDateOnly } from './format'
 import type { ChangelogRelease } from './types'
 
 export const serializeUserChangelogRelease = (release: ChangelogRelease): string => {
-  const lines: string[] = [`## Version ${release.version} - ${release.date}`, '']
+  const lines: string[] = [
+    `## Version ${release.version} - ${toChangelogDateOnly(release.date)}`,
+    '',
+  ]
 
   for (const section of sortUserReleaseSections(release.sections)) {
     if (section.items.length === 0) {

package/release-notes/sync-user-changelog.ts

@@ -3,7 +3,6 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { parseUserChangelog } from './parseChangelog.ts'
 import { serializeUserChangelogRelease } from './serializeUserChangelog.ts'
-import type { ChangelogRelease } from './types.ts'
 
 const rootDir = process.env.FG_DEVKIT_CWD
   ? path.resolve(process.env.FG_DEVKIT_CWD)
@@ -14,36 +13,6 @@ const contentPath = path.join(rootDir, 'CHANGELOG.user.md')
 const readMarkdown = (filePath: string): string =>
   existsSync(filePath) ? readFileSync(filePath, 'utf-8') : ''
 
-const updateVersionTimestamps = (
-  content: string,
-  draftReleases: ChangelogRelease[],
-): { content: string; versions: string[] } => {
-  const versions: string[] = []
-  let result = content
-
-  for (const release of draftReleases) {
-    const dateTimeMatch = release.date.match(/^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2})$/)
-    if (!dateTimeMatch) {
-      continue
-    }
-
-    const [, datePart, timePart] = dateTimeMatch
-    const headingWithoutTime = `## Version ${release.version} - ${datePart}`
-    const headingWithTime = `## Version ${release.version} - ${datePart} ${timePart}`
-
-    if (result.includes(headingWithTime)) {
-      continue
-    }
-
-    if (result.includes(headingWithoutTime)) {
-      result = result.replaceAll(headingWithoutTime, headingWithTime)
-      versions.push(release.version)
-    }
-  }
-
-  return { content: result, versions }
-}
-
 const draft = parseUserChangelog(readMarkdown(draftPath))
 const existingContent = readMarkdown(contentPath).trimEnd()
 const existing = existingContent.length > 0 ? parseUserChangelog(existingContent) : []
@@ -51,34 +20,17 @@ const existing = existingContent.length > 0 ? parseUserChangelog(existingContent
 const existingVersions = new Set(existing.map((release) => release.version))
 const newReleases = draft.filter((release) => !existingVersions.has(release.version))
 
-let mergedContent = existingContent
-
-if (newReleases.length > 0) {
-  const newBlocks = newReleases.map((release) => serializeUserChangelogRelease(release)).join('\n\n')
-  mergedContent =
-    existingContent.length > 0 ? `${newBlocks}\n\n${existingContent}` : newBlocks
-}
-
-const { content: contentWithTimestamps, versions: updatedTimestamps } = updateVersionTimestamps(
-  mergedContent,
-  draft,
-)
-
-if (newReleases.length === 0 && updatedTimestamps.length === 0) {
+if (newReleases.length === 0) {
   process.stdout.write('No user changelog changes to sync.\n')
   process.exit(0)
 }
 
-writeFileSync(contentPath, `${contentWithTimestamps.trimEnd()}\n`)
+const newBlocks = newReleases.map((release) => serializeUserChangelogRelease(release)).join('\n\n')
+const mergedContent =
+  existingContent.length > 0 ? `${newBlocks}\n\n${existingContent}` : newBlocks
 
-if (newReleases.length > 0) {
-  process.stdout.write(
-    `Added user changelog version(s): ${newReleases.map((release) => release.version).join(', ')}\n`,
-  )
-}
+writeFileSync(contentPath, `${mergedContent.trimEnd()}\n`)
 
-if (updatedTimestamps.length > 0) {
-  process.stdout.write(
-    `Updated timestamps in CHANGELOG.user.md for version(s): ${updatedTimestamps.join(', ')}\n`,
-  )
-}
+process.stdout.write(
+  `Added user changelog version(s): ${newReleases.map((release) => release.version).join(', ')}\n`,
+)

package/scaffold/vue/package.json

@@ -15,7 +15,6 @@
     "poeditor:upload": "pnpm exec fg-devkit poeditor-upload"
   },
   "dependencies": {
-    "@tailwindcss/postcss": "4.3.3",
     "@tailwindcss/vite": "4.3.3",
     "@tanstack/vue-query": "5.101.4",
     "axios": "1.19.0",
@@ -34,12 +33,12 @@
     "@tanstack/vue-query-devtools": "6.1.38",
     "@types/node": "22.16.5",
     "@vitejs/plugin-vue": "6.0.8",
-    "fg-devkit": "1.12.14",
+    "fg-devkit": "1.14.3",
     "tailwindcss": "4.3.3",
-    "tsx": "4.23.9",
+    "tsx": "4.23.12",
     "vite": "7.3.5"
   },
-  "packageManager": "pnpm@11.20.0",
+  "packageManager": "pnpm@11.21.0",
   "engines": {
     "node": ">=22.13.0"
   }

package/scripts/audit-override-commit.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Fix one vulnerability via `pnpm audit --fix override -i`, install, then auto-commit.
+ * Fix one or more vulnerabilities via `pnpm audit --fix override -i`, install, then auto-commit.
  *
  * Usage:
  *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
@@ -150,14 +150,11 @@ function main() {
     console.log('[audit-override-commit] No override changes detected.')
     process.exit(0)
   }
-  if (changed.length > 1) {
-    console.log('[audit-override-commit] Multiple override changes detected:')
-    for (const item of changed) {
-      const fromLabel = item.from ?? '(missing)'
-      console.log(`  - ${item.name}: ${fromLabel} -> ${item.to}`)
-    }
-    console.log('[audit-override-commit] Auto-commit supports exactly one override change. Commit manually.')
-    process.exit(1)
+
+  console.log('[audit-override-commit] Override changes detected:')
+  for (const item of changed) {
+    const fromLabel = item.from ?? '(missing)'
+    console.log(`  - ${item.name}: ${fromLabel} -> ${item.to}`)
   }
 
   const installExitCode = runPnpm(['install'])
@@ -165,16 +162,30 @@ function main() {
     process.exit(installExitCode)
   }
 
-  const [only] = changed
   const stageExitCode = stageExistingFiles(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'])
   if (stageExitCode !== 0) {
     process.exit(stageExitCode)
   }
 
-  const commitMessage = `vuln(${only.name}): override ${only.to}`
-  console.log(`[audit-override-commit] Staged override for ${only.name} -> ${only.to}`)
-  console.log(`[audit-override-commit] Auto-committing: ${commitMessage}`)
-  process.exit(runGit(['commit', '-m', commitMessage]))
+  const { subject, body } = buildCommitMessage(changed)
+  console.log(`[audit-override-commit] Auto-committing: ${subject}`)
+  if (body) {
+    console.log(body)
+  }
+  const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
+  process.exit(runGit(commitArgs))
+}
+
+function buildCommitMessage(changed) {
+  if (changed.length === 1) {
+    const only = changed[0]
+    return { subject: `vuln(${only.name}): override ${only.to}`, body: '' }
+  }
+
+  const body = changed
+    .map((item) => `- ${item.name}: ${item.from ?? '(missing)'} -> ${item.to}`)
+    .join('\n')
+  return { subject: `vuln(): override ${changed.length} packages`, body }
 }
 
 main()

package/scripts/fg-devkit.mjs

@@ -503,7 +503,7 @@ Commands:
   sync-deps-commit [policy-file]  Sync dependency policy, pnpm install, then auto-commit
   policy-outdated [policy-file]   Show outdated policy packages via pnpm outdated
   policy-vulns [policy-file]      Check all policy packages together (including transitives) via pnpm audit
-  repo-vulns                      Check all repo dependencies for vulnerabilities via pnpm audit
+  repo-vulns                      Check repo + nested lockfile packages via pnpm audit
   fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
                                  Run pnpm audit across Vue repos (full output + combined summary)
   fleet-bump-fg-devkit [projects-root] [--dry-run]
@@ -535,11 +535,11 @@ Commands:
                                  Maintainer: discard tracked git changes in chosen repositories
                                  Options: --dry-run, --fg-devkit-only, --pick, --all, --only=a,b
   policy-upgrade [policy-file] [ncu-args...]
-                                 Upgrade policy packages via npm-check-updates (default interactive)
+                                 Upgrade policy packages via ncu (interactive) and auto-commit
   policy-upgrade-commit [ncu-args...]
-                                 Upgrade one consumer package.json package and auto-commit
+                                 Upgrade one or more consumer package.json packages and auto-commit
   audit-override-commit [pnpm-audit-args...]
-                                 Fix one vulnerability override via pnpm audit and auto-commit
+                                 Fix one or more vulnerability overrides via pnpm audit and auto-commit
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
@@ -785,8 +785,8 @@ async function runInteractiveMenu() {
         choices: [
           { name: 'Check', value: 'check' },
           { name: 'Sync and auto-commit', value: 'sync-commit' },
-          { name: 'Upgrade one package.json package and auto-commit', value: 'upgrade-commit' },
-          { name: 'Fix one vulnerability override and auto-commit', value: 'audit-override-commit' },
+          { name: 'Upgrade package.json packages and auto-commit', value: 'upgrade-commit' },
+          { name: 'Fix vulnerability overrides and auto-commit', value: 'audit-override-commit' },
           { name: 'Cancel', value: 'cancel' },
         ],
         default: 'check',
@@ -857,7 +857,7 @@ async function runInteractiveMenu() {
         message: 'Maintainer',
         choices: [
           { name: 'Show outdated dependency policy packages', value: 'm1' },
-          { name: 'Upgrade dependency policy (interactive)', value: 'm2' },
+          { name: 'Upgrade dependency policy (interactive) and auto-commit', value: 'm2' },
           { name: 'Refresh dependency policy from repos (and scaffold/vue package.json)', value: 'm3' },
           { name: 'Check policy vulnerabilities (audit)', value: 'm4' },
           { name: 'Check fg-devkit repo vulnerabilities', value: 'm5' },

package/scripts/fleet-bump-fg-devkit.mjs

@@ -3,47 +3,86 @@
  * Bumps fg-devkit to latest in Vue repositories, syncs dependency policy, and runs pnpm install.
  *
  * Usage:
- *   pnpm exec fg-devkit fleet-bump-fg-devkit [projects-root] [--dry-run]
+ *   pnpm exec fg-devkit fleet-bump-fg-devkit [projects-root] [options]
+ *
+ * Options:
+ *   --dry-run         Print planned bumps without changing files or installing
+ *   --all             Run on all matching Vue repos (default when not picking)
+ *   --fg-devkit-only  No-op for this command (fg-devkit is not a consumer of itself)
+ *   --pick            Interactive checkbox (TTY); prefer --only= from automation/UI
+ *   --only=a,b        Run only on matching repos (basename or path under projects root)
  */
 
+import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 
 import { collectFleetVueRepos } from './fleet-vue-repos.mjs'
+import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const cliArgs = process.argv.slice(2)
 const dryRun = cliArgs.includes('--dry-run')
-const projectsRootArg = cliArgs.find((a) => !a.startsWith('-'))
-const projectsRoot = projectsRootArg ? path.resolve(process.cwd(), projectsRootArg) : path.resolve(scriptDir, '../..')
+const fgDevkitOnly = cliArgs.includes('--fg-devkit-only')
+const { pick, all, only, filteredArgs: positionalArgs } = parseFleetSelectionFlags(cliArgs)
+const projectsRootArg = positionalArgs.find((a) => !a.startsWith('-'))
+const projectsRoot = projectsRootArg
+  ? path.resolve(process.cwd(), projectsRootArg)
+  : path.resolve(scriptDir, '../..')
+
+const LOG_PREFIX = '[fleet-bump-fg-devkit]'
+
+if (fgDevkitOnly) {
+  console.log(
+    `${LOG_PREFIX} Nothing to do for fg-devkit only — bump targets Vue consumer repos that depend on fg-devkit.`,
+  )
+  process.exit(0)
+}
+
+if (!fs.existsSync(projectsRoot)) {
+  console.error(`${LOG_PREFIX} projects root not found: ${projectsRoot}`)
+  process.exit(1)
+}
+
+const allRepos = collectFleetVueRepos(projectsRoot)
+if (allRepos.length === 0) {
+  console.log(`${LOG_PREFIX} No Vue repositories with fg-devkit found under ${projectsRoot}`)
+  process.exit(0)
+}
+
+const uniqueRepos = await resolveFleetRepos(allRepos, projectsRoot, {
+  pick,
+  only,
+  all: all || (!pick && !only),
+  message: 'Select Vue repositories to bump fg-devkit',
+})
 
-const uniqueRepos = collectFleetVueRepos(projectsRoot)
 if (uniqueRepos.length === 0) {
-  console.log(`[fleet-bump-fg-devkit] No Vue repositories with fg-devkit found under ${projectsRoot}`)
+  console.log(`${LOG_PREFIX} No repositories selected.`)
   process.exit(0)
 }
 
-console.log(`[fleet-bump-fg-devkit] projectsRoot=${projectsRoot}`)
-console.log(`[fleet-bump-fg-devkit] repositories=${uniqueRepos.length}`)
+console.log(`${LOG_PREFIX} projectsRoot=${projectsRoot}`)
+console.log(`${LOG_PREFIX} repositories=${uniqueRepos.length}`)
 
 let failures = 0
 let updated = 0
 
 for (const repoDir of uniqueRepos) {
-  const repoName = path.basename(repoDir)
+  const repoName = path.relative(projectsRoot, repoDir).split(path.sep).join('/') || path.basename(repoDir)
   const bumpArgs = ['up', 'fg-devkit@latest']
   const syncDepsArgs = ['exec', 'fg-devkit', 'sync-deps']
   const installArgs = ['install']
 
   if (dryRun) {
-    console.log(`[fleet-bump-fg-devkit] DRY RUN ${repoName}: pnpm ${bumpArgs.join(' ')}`)
-    console.log(`[fleet-bump-fg-devkit] DRY RUN ${repoName}: pnpm ${syncDepsArgs.join(' ')}`)
-    console.log(`[fleet-bump-fg-devkit] DRY RUN ${repoName}: pnpm ${installArgs.join(' ')}`)
+    console.log(`${LOG_PREFIX} DRY RUN ${repoName}: pnpm ${bumpArgs.join(' ')}`)
+    console.log(`${LOG_PREFIX} DRY RUN ${repoName}: pnpm ${syncDepsArgs.join(' ')}`)
+    console.log(`${LOG_PREFIX} DRY RUN ${repoName}: pnpm ${installArgs.join(' ')}`)
     continue
   }
 
-  console.log(`\n[fleet-bump-fg-devkit] Updating ${repoName}`)
+  console.log(`\n${LOG_PREFIX} Updating ${repoName}`)
   const bump = spawnSync('pnpm', bumpArgs, {
     cwd: repoDir,
     stdio: 'inherit',
@@ -56,14 +95,14 @@ for (const repoDir of uniqueRepos) {
 
   if (bump.error) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: ${bump.error.message}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: ${bump.error.message}`)
     continue
   }
 
   const bumpStatus = bump.status ?? 1
   if (bumpStatus !== 0) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: pnpm up exited with code ${bumpStatus}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: pnpm up exited with code ${bumpStatus}`)
     continue
   }
 
@@ -79,14 +118,14 @@ for (const repoDir of uniqueRepos) {
 
   if (syncDeps.error) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: ${syncDeps.error.message}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: ${syncDeps.error.message}`)
     continue
   }
 
   const syncDepsStatus = syncDeps.status ?? 1
   if (syncDepsStatus !== 0) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: sync-deps exited with code ${syncDepsStatus}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: sync-deps exited with code ${syncDepsStatus}`)
     continue
   }
 
@@ -102,20 +141,20 @@ for (const repoDir of uniqueRepos) {
 
   if (install.error) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: ${install.error.message}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: ${install.error.message}`)
     continue
   }
 
   const status = install.status ?? 1
   if (status !== 0) {
     failures += 1
-    console.error(`[fleet-bump-fg-devkit] FAIL ${repoName}: pnpm install exited with code ${status}`)
+    console.error(`${LOG_PREFIX} FAIL ${repoName}: pnpm install exited with code ${status}`)
     continue
   }
 
   updated += 1
-  console.log(`[fleet-bump-fg-devkit] OK ${repoName}`)
+  console.log(`${LOG_PREFIX} OK ${repoName}`)
 }
 
-console.log(`\n[fleet-bump-fg-devkit] Done: updated=${updated}, failed=${failures}`)
+console.log(`\n${LOG_PREFIX} Done: updated=${updated}, failed=${failures}`)
 process.exit(failures > 0 ? 1 : 0)

package/scripts/fleet-vulns.mjs

@@ -4,7 +4,7 @@
  * pnpm audit output and a combined summary.
  *
  * Usage:
- *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
+ *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>] [--dry-run] [--only=a,b]
  */
 
 import fs from 'node:fs'
@@ -12,10 +12,13 @@ import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { isFgDevkitRepoDir } from './fleet-project-repos.mjs'
+import { filterReposByOnly, parseFleetOnlyArg } from './fleet-repo-picker.mjs'
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const cliArgs = process.argv.slice(2)
 const summaryOnly = cliArgs.includes('--summary-only')
+const dryRun = cliArgs.includes('--dry-run')
+const only = parseFleetOnlyArg(cliArgs)
 const projectsRootArg = cliArgs.find((a) => !a.startsWith('-'))
 const projectsRoot = projectsRootArg ? path.resolve(process.cwd(), projectsRootArg) : path.resolve(scriptDir, '../..')
 const delayArg = cliArgs.find((a) => a.startsWith('--delay-ms='))
@@ -63,7 +66,16 @@ for (const packageJsonPath of packageJsonFiles) {
   }
 }
 
-const uniqueRepos = [...new Set(repos)].sort((a, b) => a.localeCompare(b))
+const uniqueReposAll = [...new Set(repos)].sort((a, b) => a.localeCompare(b))
+let uniqueRepos = uniqueReposAll
+if (only?.length) {
+  uniqueRepos = filterReposByOnly(uniqueReposAll, projectsRoot, only)
+  if (uniqueRepos.length === 0) {
+    console.error(`[fleet-vulns] No repositories matched --only=${only.join(',')}`)
+    process.exit(1)
+  }
+}
+
 if (uniqueRepos.length === 0) {
   console.log(`[fleet-vulns] No pnpm repositories found under ${projectsRoot}`)
   process.exit(0)
@@ -72,6 +84,16 @@ if (uniqueRepos.length === 0) {
 console.log(`[fleet-vulns] projectsRoot=${projectsRoot}`)
 console.log(`[fleet-vulns] repositories=${uniqueRepos.length}`)
 
+if (dryRun) {
+  console.log('[fleet-vulns] DRY RUN — would audit:')
+  for (const repoDir of uniqueRepos) {
+    const rel = path.relative(projectsRoot, repoDir).split(path.sep).join('/') || path.basename(repoDir)
+    const hasLock = fs.existsSync(path.join(repoDir, 'pnpm-lock.yaml'))
+    console.log(`  - ${rel}${hasLock ? '' : ' (missing pnpm-lock.yaml → skip)'}`)
+  }
+  process.exit(0)
+}
+
 const results = []
 let hasFailures = false
 let hasVulnerabilities = false

package/scripts/policy-upgrade-commit.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Upgrade one package in the consumer package.json, then auto-commit.
+ * Upgrade one or more packages in the consumer package.json, then auto-commit.
  *
  * Usage:
  *   pnpm exec fg-devkit policy-upgrade-commit [ncu-args...]
@@ -139,25 +139,34 @@ function main() {
     console.log('[policy-upgrade-commit] No package version changes detected in package.json.')
     process.exit(0)
   }
-  if (changed.length > 1) {
-    console.log('[policy-upgrade-commit] Multiple package changes detected in package.json:')
-    for (const item of changed) {
-      console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
-    }
-    console.log('[policy-upgrade-commit] Auto-commit supports exactly one changed package. Commit manually.')
-    process.exit(1)
+
+  console.log('[policy-upgrade-commit] Package version changes detected in package.json:')
+  for (const item of changed) {
+    console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
   }
 
-  const [only] = changed
   const stageExitCode = stageExistingFiles(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'])
   if (stageExitCode !== 0) {
     process.exit(stageExitCode)
   }
 
-  const commitMessage = `dep(${only.name}): bump to ${only.to}`
-  console.log(`[policy-upgrade-commit] Staged changes for ${only.name} -> ${only.to}`)
-  console.log(`[policy-upgrade-commit] Auto-committing: ${commitMessage}`)
-  process.exit(runGit(['commit', '-m', commitMessage]))
+  const { subject, body } = buildCommitMessage(changed)
+  console.log(`[policy-upgrade-commit] Auto-committing: ${subject}`)
+  if (body) {
+    console.log(body)
+  }
+  const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
+  process.exit(runGit(commitArgs))
+}
+
+function buildCommitMessage(changed) {
+  if (changed.length === 1) {
+    const only = changed[0]
+    return { subject: `dep(${only.name}): bump to ${only.to}`, body: '' }
+  }
+
+  const body = changed.map((item) => `- ${item.name}: ${item.from} -> ${item.to}`).join('\n')
+  return { subject: `dep(): bump ${changed.length} packages`, body }
 }
 
 main()

package/scripts/policy-upgrade.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 /**
- * Upgrades dependency policy package versions through npm-check-updates.
- * It projects the policy into a temporary package.json, runs ncu, then writes
- * selected versions back to the policy file.
+ * Upgrades dependency policy package versions through npm-check-updates, then auto-commits.
+ * It projects the policy into a temporary package.json, runs ncu, writes selected versions
+ * back to the policy file, syncs scaffold, and commits.
  *
  * Usage:
  *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
@@ -22,6 +22,7 @@ import { syncScaffoldVueDepsFromPolicy } from './sync-scaffold-vue-deps.mjs'
 
 const require = createRequire(import.meta.url)
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const fgDevkitRoot = path.resolve(scriptDir, '..')
 
 if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log(`Usage:
@@ -42,7 +43,60 @@ function readJson(p) {
   return JSON.parse(fs.readFileSync(p, 'utf8'))
 }
 
+function collectPolicyVersions(policy) {
+  return {
+    ...(policy.managedDependencies?.dependencies ?? {}),
+    ...(policy.managedDependencies?.devDependencies ?? {}),
+    ...(policy.managedAnywhere ?? {}),
+  }
+}
+
+function collectVersionChanges(before, after) {
+  const changed = []
+  for (const [name, newVersion] of Object.entries(after)) {
+    const previousVersion = before[name]
+    if (previousVersion !== undefined && previousVersion !== newVersion) {
+      changed.push({ name, from: previousVersion, to: newVersion })
+    }
+  }
+  return changed
+}
+
+function buildCommitMessage(changed) {
+  if (changed.length === 1) {
+    const only = changed[0]
+    return { subject: `dep(${only.name}): bump to ${only.to}`, body: '' }
+  }
+
+  const body = changed.map((item) => `- ${item.name}: ${item.from} -> ${item.to}`).join('\n')
+  return { subject: `dep(): bump ${changed.length} packages`, body }
+}
+
+function runGit(args) {
+  const result = spawnSync('git', args, {
+    stdio: 'inherit',
+    cwd: fgDevkitRoot,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[policy-upgrade]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function stageExistingFiles(files) {
+  const existingFiles = files.filter((filePath) => fs.existsSync(path.join(fgDevkitRoot, filePath)))
+  if (existingFiles.length === 0) return 0
+  return runGit(['add', '--', ...existingFiles])
+}
+
+function toRepoRelative(absolutePath) {
+  return path.relative(fgDevkitRoot, absolutePath)
+}
+
 const policy = readJson(policyPath)
+const beforeVersions = collectPolicyVersions(policy)
 
 const depNames = new Set(Object.keys(policy.managedDependencies?.dependencies ?? {}))
 const devNames = new Set(Object.keys(policy.managedDependencies?.devDependencies ?? {}))
@@ -115,6 +169,34 @@ for (const [name, version] of Object.entries(updatedDevDeps)) {
 }
 
 fs.writeFileSync(policyPath, `${JSON.stringify(policy, null, 2)}\n`, 'utf8')
-const fgDevkitRoot = path.resolve(scriptDir, '..')
 syncScaffoldVueDepsFromPolicy({ fgDevkitRoot, policyPath })
-console.log('[policy-upgrade] Updated dependency policy from selected ncu changes.')
+
+const afterPolicy = readJson(policyPath)
+const changed = collectVersionChanges(beforeVersions, collectPolicyVersions(afterPolicy))
+
+if (changed.length === 0) {
+  console.log('[policy-upgrade] No package version changes detected in dependency policy.')
+  process.exit(0)
+}
+
+console.log('[policy-upgrade] Package version changes detected in dependency policy:')
+for (const item of changed) {
+  console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
+}
+
+const stageExitCode = stageExistingFiles([
+  toRepoRelative(policyPath),
+  'scaffold/vue/package.json',
+  'scaffold/vue/Dockerfile.local',
+])
+if (stageExitCode !== 0) {
+  process.exit(stageExitCode)
+}
+
+const { subject, body } = buildCommitMessage(changed)
+console.log(`[policy-upgrade] Auto-committing: ${subject}`)
+if (body) {
+  console.log(body)
+}
+const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
+process.exit(runGit(commitArgs))

package/scripts/repo-vulns.mjs

@@ -1,26 +1,83 @@
 #!/usr/bin/env node
 /**
  * Checks vulnerabilities for the full dependency graph in the current repository
- * by running `pnpm audit` in the working directory.
+ * by running `pnpm audit` in the working directory and any nested packages that
+ * have their own pnpm-lock.yaml (e.g. electron/maintainer-ui in fg-devkit).
  *
  * Usage:
  *   pnpm exec fg-devkit repo-vulns
  */
 
+import fs from 'node:fs'
+import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 
-console.log(`[repo-vulns] cwd=${process.cwd()}`)
-const audit = spawnSync('pnpm', ['audit'], {
-  cwd: process.cwd(),
-  stdio: 'inherit',
-  env: process.env,
-})
-if (audit.error) {
-  console.error('[repo-vulns]', audit.error.message)
-  process.exit(1)
+const root = process.cwd()
+
+const SKIP_DIR_NAMES = new Set([
+  'node_modules',
+  '.git',
+  '.next',
+  'dist',
+  'build',
+  'coverage',
+  'storybook-static',
+])
+
+/**
+ * @param {string} dir
+ * @param {string[]} [acc]
+ * @returns {string[]}
+ */
+function findNestedLockfileDirs(dir, acc = []) {
+  for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (!item.isDirectory()) continue
+    if (SKIP_DIR_NAMES.has(item.name) || item.name.startsWith('.')) continue
+    const child = path.join(dir, item.name)
+    if (
+      fs.existsSync(path.join(child, 'pnpm-lock.yaml')) &&
+      fs.existsSync(path.join(child, 'package.json'))
+    ) {
+      acc.push(child)
+    }
+    findNestedLockfileDirs(child, acc)
+  }
+  return acc
 }
-// pnpm audit returns exit code 1 when vulnerabilities are found.
-if ((audit.status ?? 1) === 1) {
-  process.exit(0)
+
+/**
+ * @param {string} dir
+ * @param {string} label
+ * @returns {number}
+ */
+function auditDir(dir, label) {
+  console.log(`\n[repo-vulns] Auditing ${label}`)
+  console.log(`[repo-vulns] cwd=${dir}`)
+  const audit = spawnSync('pnpm', ['audit'], {
+    cwd: dir,
+    stdio: 'inherit',
+    env: process.env,
+  })
+  if (audit.error) {
+    console.error('[repo-vulns]', audit.error.message)
+    return 1
+  }
+  return audit.status ?? 1
 }
-process.exit(audit.status ?? 1)
+
+const nested = findNestedLockfileDirs(root).sort((a, b) => a.localeCompare(b))
+const targets = [root, ...nested]
+
+console.log(`[repo-vulns] packages=${targets.length}`)
+
+let worstFailure = 0
+
+for (const dir of targets) {
+  const label = dir === root ? '.' : path.relative(root, dir).split(path.sep).join('/')
+  const code = auditDir(dir, label)
+  // pnpm audit returns exit code 1 when vulnerabilities are found — treat as ok.
+  if (code === 0 || code === 1) continue
+  worstFailure = code || 1
+}
+
+process.exit(worstFailure)

package/scripts/resolve-dependency-policy-path.mjs

@@ -2,7 +2,7 @@
  * Resolves which dependency policy JSON file check/sync scripts should load.
  *
  * Used by check-dependency-policy.mjs and sync-dependency-policy.mjs so both tools share one rule:
- * optional argv[2] override, otherwise the packaged default next to this package.
+ * optional argv[2] override (ignored when it looks like a CLI flag), otherwise the packaged default.
  */
 
 import fs from 'node:fs'
@@ -17,8 +17,10 @@ const DEFAULT_POLICY = 'dependency-policy.vue-workspace.json'
  * - Relative path: if it exists under cwd, use it; else fg-devkit/configs/<arg>
  */
 export function resolveDependencyPolicyPath(scriptDir, cwd, argv) {
+  // Optional policy path is argv[2] only when it is not an option flag
+  // (e.g. `policy-upgrade --interactive` must use the default policy file).
   const arg = argv[2]
-  if (!arg) {
+  if (!arg || arg.startsWith('-')) {
     return path.resolve(scriptDir, '../configs', DEFAULT_POLICY)
   }
   if (path.isAbsolute(arg)) {