fg-devkit 1.16.2 → 1.17.1

package/.cursor/rules/core-coding-standards.mdc

@@ -67,6 +67,8 @@ alwaysApply: true
 - Set `staleTime` intentionally per resource; keep `refetchOnWindowFocus` off unless fresh-on-focus behavior is required.
 - On mutation success, update cache intentionally (`setQueryData`) and/or invalidate the narrowest matching keys.
 - Respect shared query client retry behavior and only override retries when endpoint-specific behavior is needed.
+- TanStack Query boolean flags (`isPending`, `isSuccess`, `isError`) are typed `Ref<false> | Ref<true>`. `vue-tsc` unwraps that union in templates to `boolean`; the Vue language plugin may not.
+- Narrow in script (`const isPending = mutation.isPending as Ref<boolean>`), then bind without `.value` (`:loading="isPending"`). Do not use `.value` in templates (fails `vue-tsc`) and do not add a wrapping `computed` only to satisfy the editor.
 
 ## Mutation cache behavior
 

package/README.md

@@ -139,13 +139,27 @@ Upgrade one or more package.json dependencies and auto-commit
 pnpm exec fgd policy-upgrade-commit
 ```
 
-Fix one or more vulnerability overrides interactively and auto-commit
-(`vuln(package): override version`, or `vuln(): override N packages` with a body listing each change):
+Same upgrade, then prune unused workspace overrides in a second commit if any can be dropped:
+
+```bash
+pnpm exec fgd policy-upgrade-commit --prune-overrides
+```
+
+Fix one or more vulnerability overrides interactively, prune unused overrides, and auto-commit
+(`vuln(package): override version`, `vuln(package): prune override`, or `vuln(): override N packages` with a body listing each change):
 
 ```bash
 pnpm exec fgd audit-override-commit
 ```
 
+Report, remove, or remove and auto-commit workspace overrides that no longer change `pnpm audit`:
+
+```bash
+pnpm exec fgd prune-overrides
+pnpm exec fgd prune-overrides --fix
+pnpm exec fgd prune-overrides --commit
+```
+
 ## tsconfig in consuming repos
 
 Use `fgd sync-project-configs` (or `fgd sync-tooling-configs`) to write the local `tsconfig.json` template from `fg-devkit`.

package/configs/dependency-policy.vue-workspace.json

@@ -17,7 +17,7 @@
       "@lexical/rich-text": "0.49.0",
       "@lexical/link": "0.49.0",
       "@piwikpro/vue-piwik-pro": "1.7.1",
-      "@sentry/vue": "10.73.0",
+      "@sentry/vue": "10.74.0",
       "@tanstack/vue-query": "5.102.8",
       "@types/leaflet": "1.9.22",
       "@unhead/vue": "2.0.5",
@@ -77,7 +77,7 @@
       "eslint-plugin-storybook": "10.6.0",
       "globals": "15.11.0",
       "jsdom": "26.1.0",
-      "sass": "1.104.0",
+      "sass": "1.104.1",
       "storybook": "10.6.0",
       "tsx": "4.23.13",
       "vega": "6.4.0",
@@ -85,12 +85,12 @@
       "vite-plugin-vue-devtools": "8.2.1",
       "vite-plugin-vue-inspector": "7.0.0",
       "vitest": "4.1.10",
-      "yaml": "2.9.0"
+      "yaml": "2.9.1"
     }
   },
   "managedAnywhere": {
     "@tailwindcss/vite": "4.3.3",
-    "@vitejs/plugin-vue": "6.0.8",
+    "@vitejs/plugin-vue": "6.0.9",
     "axios": "1.20.0",
     "dotenv": "16.4.5",
     "qrcode.vue": "3.11.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.16.2",
+  "version": "1.17.1",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -53,7 +53,9 @@
     "./scripts/fleet-git-discard-scoped.mjs": "./scripts/fleet-git-discard-scoped.mjs",
     "./scripts/policy-upgrade.mjs": "./scripts/policy-upgrade.mjs",
     "./scripts/policy-upgrade-commit.mjs": "./scripts/policy-upgrade-commit.mjs",
+    "./scripts/override-changes.mjs": "./scripts/override-changes.mjs",
     "./scripts/audit-override-commit.mjs": "./scripts/audit-override-commit.mjs",
+    "./scripts/prune-overrides.mjs": "./scripts/prune-overrides.mjs",
     "./scripts/check-dependency-policy.mjs": "./scripts/check-dependency-policy.mjs",
     "./scripts/sync-dependency-policy.mjs": "./scripts/sync-dependency-policy.mjs",
     "./scripts/sync-dependency-policy-commit.mjs": "./scripts/sync-dependency-policy-commit.mjs",
@@ -103,12 +105,12 @@
   },
   "dependencies": {
     "@inquirer/checkbox": "4.3.2",
-    "@inquirer/confirm": "6.3.1",
-    "@inquirer/input": "5.1.5",
-    "@inquirer/select": "5.2.4",
+    "@inquirer/confirm": "6.3.2",
+    "@inquirer/input": "5.1.6",
+    "@inquirer/select": "5.2.5",
     "@intlify/eslint-plugin-vue-i18n": "4.5.1",
-    "@typescript-eslint/eslint-plugin": "8.69.0",
-    "@typescript-eslint/parser": "8.69.0",
+    "@typescript-eslint/eslint-plugin": "8.70.0",
+    "@typescript-eslint/parser": "8.70.0",
     "@vitest/eslint-plugin": "1.6.27",
     "@vue/eslint-config-prettier": "10.2.0",
     "@vue/eslint-config-typescript": "14.9.0",
@@ -118,7 +120,7 @@
     "eslint-plugin-vue": "10.11.0",
     "fallow": "2.101.0",
     "git-cliff": "2.13.1",
-    "lefthook": "2.1.12",
+    "lefthook": "2.1.14",
     "npm-check-updates": "22.2.7",
     "prettier": "3.9.6",
     "tsx": "4.23.13",

package/scaffold/vue/package.json

@@ -32,8 +32,8 @@
     "@intlify/unplugin-vue-i18n": "11.2.5",
     "@tanstack/vue-query-devtools": "6.1.48",
     "@types/node": "22.16.5",
-    "@vitejs/plugin-vue": "6.0.8",
-    "fg-devkit": "1.16.2",
+    "fg-devkit": "1.17.1",
+    "@vitejs/plugin-vue": "6.0.9",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.13",
     "vite": "7.3.5",

package/scripts/audit-override-commit.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 /**
- * Fix one or more vulnerabilities via `pnpm audit --fix override -i`, install, then auto-commit.
+ * Fix one or more vulnerabilities via `pnpm audit --fix override -i`, prune unused
+ * overrides, install, then auto-commit.
  *
  * Usage:
  *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
@@ -9,79 +10,17 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import {
+  buildOverrideCommitMessage,
+  collectOverrideChanges,
+  collectOverrides,
+  formatOverrideValue,
+} from './override-changes.mjs'
 
 const cwd = process.cwd()
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const packageJsonPath = path.join(cwd, 'package.json')
-const workspaceYamlPath = path.join(cwd, 'pnpm-workspace.yaml')
-
-/** Strip surrounding single/double quotes from YAML scalar keys/values. */
-function unquoteYamlScalar(value) {
-  if (
-    (value.startsWith("'") && value.endsWith("'")) ||
-    (value.startsWith('"') && value.endsWith('"'))
-  ) {
-    return value.slice(1, -1)
-  }
-  return value
-}
-
-function getOverridePackageName(overrideKey) {
-  const key = unquoteYamlScalar(overrideKey.trim())
-  const match = key.match(/^(@[^/]+\/[^@]+|[^@]+)@/)
-  return match ? match[1] : key
-}
-
-/** Read flat `overrides:` entries from pnpm-workspace.yaml (no YAML dependency). */
-function readWorkspaceOverrides(yamlPath) {
-  if (!fs.existsSync(yamlPath)) return {}
-  const overrides = {}
-  let inOverrides = false
-  for (const line of fs.readFileSync(yamlPath, 'utf8').split('\n')) {
-    if (/^overrides:\s*$/.test(line)) {
-      inOverrides = true
-      continue
-    }
-    if (!inOverrides) continue
-    if (/^\S/.test(line)) break
-    const match = line.match(/^  ([^:]+):\s*(.+?)\s*$/)
-    if (match) {
-      const key = unquoteYamlScalar(match[1].trim())
-      const value = unquoteYamlScalar(match[2].trim())
-      overrides[key] = value
-    }
-  }
-  return overrides
-}
-
-function readJson(jsonPath) {
-  return JSON.parse(fs.readFileSync(jsonPath, 'utf8'))
-}
-
-function collectOverrides() {
-  const overrides = {}
-
-  if (fs.existsSync(packageJsonPath)) {
-    const pkg = readJson(packageJsonPath)
-    Object.assign(overrides, pkg.overrides ?? {})
-    Object.assign(overrides, pkg.pnpm?.overrides ?? {})
-  }
-
-  Object.assign(overrides, readWorkspaceOverrides(workspaceYamlPath))
-  return overrides
-}
-
-function collectOverrideChanges(before, after) {
-  const changed = []
-  const keys = new Set([...Object.keys(before), ...Object.keys(after)])
-  for (const key of keys) {
-    const from = before[key]
-    const to = after[key]
-    if (to !== undefined && from !== to) {
-      changed.push({ key, name: getOverridePackageName(key), from, to })
-    }
-  }
-  return changed
-}
 
 function runPnpm(args) {
   const result = spawnSync('pnpm', args, {
@@ -109,6 +48,20 @@ function runGit(args) {
   return result.status ?? 1
 }
 
+function runPruneOverridesFix() {
+  console.log('[audit-override-commit] Pruning overrides that no longer affect pnpm audit…')
+  const result = spawnSync(process.execPath, [path.join(scriptDir, 'prune-overrides.mjs'), '--fix'], {
+    stdio: 'inherit',
+    cwd,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[audit-override-commit]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
 function stageExistingFiles(files) {
   const existingFiles = files.filter((filePath) => fs.existsSync(path.join(cwd, filePath)))
   if (existingFiles.length === 0) return 0
@@ -123,7 +76,7 @@ function main() {
 
   let beforeOverrides
   try {
-    beforeOverrides = collectOverrides()
+    beforeOverrides = collectOverrides(cwd)
   } catch (err) {
     console.error(`[audit-override-commit] Failed to read overrides before audit fix: ${err.message}`)
     process.exit(1)
@@ -137,9 +90,19 @@ function main() {
     process.exit(auditExitCode)
   }
 
+  const installExitCode = runPnpm(['install'])
+  if (installExitCode !== 0) {
+    process.exit(installExitCode)
+  }
+
+  const pruneExitCode = runPruneOverridesFix()
+  if (pruneExitCode !== 0) {
+    process.exit(pruneExitCode)
+  }
+
   let afterOverrides
   try {
-    afterOverrides = collectOverrides()
+    afterOverrides = collectOverrides(cwd)
   } catch (err) {
     console.error(`[audit-override-commit] Failed to read overrides after audit fix: ${err.message}`)
     process.exit(1)
@@ -154,12 +117,7 @@ function main() {
   console.log('[audit-override-commit] Override changes detected:')
   for (const item of changed) {
     const fromLabel = item.from ?? '(missing)'
-    console.log(`  - ${item.name}: ${fromLabel} -> ${item.to}`)
-  }
-
-  const installExitCode = runPnpm(['install'])
-  if (installExitCode !== 0) {
-    process.exit(installExitCode)
+    console.log(`  - ${item.name}: ${fromLabel} -> ${formatOverrideValue(item.to)}`)
   }
 
   const stageExitCode = stageExistingFiles(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'])
@@ -167,7 +125,7 @@ function main() {
     process.exit(stageExitCode)
   }
 
-  const { subject, body } = buildCommitMessage(changed)
+  const { subject, body } = buildOverrideCommitMessage(changed)
   console.log(`[audit-override-commit] Auto-committing: ${subject}`)
   if (body) {
     console.log(body)
@@ -176,16 +134,4 @@ function main() {
   process.exit(runGit(commitArgs))
 }
 
-function buildCommitMessage(changed) {
-  if (changed.length === 1) {
-    const only = changed[0]
-    return { subject: `vuln(${only.name}): override ${only.to}`, body: '' }
-  }
-
-  const body = changed
-    .map((item) => `- ${item.name}: ${item.from ?? '(missing)'} -> ${item.to}`)
-    .join('\n')
-  return { subject: `vuln(): override ${changed.length} packages`, body }
-}
-
 main()

package/scripts/fg-devkit.mjs

@@ -15,8 +15,9 @@
  *   pnpm exec fg-devkit sync-node-toolchain [policy-file] [--dry-run]
  *   pnpm exec fg-devkit bump-node-toolchain [nvmrc-version] [projects-root] [--dry-run] [--skip-fleet] [--no-engines]
  *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
- *   pnpm exec fg-devkit policy-upgrade-commit [ncu-args...]
+ *   pnpm exec fg-devkit policy-upgrade-commit [--prune-overrides] [ncu-args...]
  *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
+ *   pnpm exec fg-devkit prune-overrides [--fix] [--commit]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
  *   pnpm exec fg-devkit sync-vscode-settings
@@ -474,6 +475,7 @@ const DIRECT_COMMANDS = {
   'policy-upgrade': 'policy-upgrade.mjs',
   'policy-upgrade-commit': 'policy-upgrade-commit.mjs',
   'audit-override-commit': 'audit-override-commit.mjs',
+  'prune-overrides': 'prune-overrides.mjs',
   'sync-project-configs': 'sync-project-configs.mjs',
   'sync-tooling-configs': 'sync-tooling-configs.mjs',
   'sync-vscode-settings': 'sync-vscode-settings.mjs',
@@ -532,10 +534,13 @@ Commands:
                                  Options: --dry-run, --fg-devkit-only, --pick, --all, --only=a,b
   policy-upgrade [policy-file] [ncu-args...]
                                  Upgrade policy packages via ncu (interactive) and auto-commit
-  policy-upgrade-commit [ncu-args...]
-                                 Upgrade one or more consumer package.json packages and auto-commit
+  policy-upgrade-commit [--prune-overrides] [ncu-args...]
+                                 Upgrade consumer package.json packages and auto-commit
+                                 --prune-overrides also drops unused workspace overrides in a second commit
   audit-override-commit [pnpm-audit-args...]
-                                 Fix one or more vulnerability overrides via pnpm audit and auto-commit
+                                 Fix vulnerability overrides via pnpm audit, prune unused ones, auto-commit
+  prune-overrides [--fix] [--commit]
+                                 Report unused workspace overrides; --fix removes them; --commit also auto-commits
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
@@ -812,7 +817,9 @@ async function runInteractiveMenu() {
           { name: 'Check', value: 'check' },
           { name: 'Sync and auto-commit', value: 'sync-commit' },
           { name: 'Upgrade package.json packages and auto-commit', value: 'upgrade-commit' },
+          { name: 'Upgrade package.json packages, prune overrides, and auto-commit', value: 'upgrade-commit-prune' },
           { name: 'Fix vulnerability overrides and auto-commit', value: 'audit-override-commit' },
+          { name: 'Prune unused vulnerability overrides and auto-commit', value: 'prune-overrides' },
           { name: 'Cancel', value: 'cancel' },
         ],
         default: 'check',
@@ -823,10 +830,19 @@ async function runInteractiveMenu() {
       if (choice === 'sync-commit') {
         return runSelectedAction(() => runNode('sync-dependency-policy-commit.mjs'))
       }
+      if (choice === 'upgrade-commit') {
+        return runSelectedAction(() => runNode('policy-upgrade-commit.mjs'))
+      }
+      if (choice === 'upgrade-commit-prune') {
+        return runSelectedAction(() => runNode('policy-upgrade-commit.mjs', ['--prune-overrides']))
+      }
       if (choice === 'audit-override-commit') {
         return runSelectedAction(() => runNode('audit-override-commit.mjs'))
       }
-      return runSelectedAction(() => runNode('policy-upgrade-commit.mjs'))
+      if (choice === 'prune-overrides') {
+        return runSelectedAction(() => runNode('prune-overrides.mjs', ['--commit']))
+      }
+      return 1
     }
 
     if (group === 'sync-configs') {

package/scripts/override-changes.mjs

@@ -0,0 +1,83 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+function unquoteYamlScalar(value) {
+  if (
+    (value.startsWith("'") && value.endsWith("'")) ||
+    (value.startsWith('"') && value.endsWith('"'))
+  ) {
+    return value.slice(1, -1)
+  }
+  return value
+}
+
+export function getOverridePackageName(overrideKey) {
+  const key = unquoteYamlScalar(overrideKey.trim())
+  const match = key.match(/^(@[^/]+\/[^@]+|[^@]+)@/)
+  return match ? match[1] : key
+}
+
+function readWorkspaceOverrides(yamlPath) {
+  if (!fs.existsSync(yamlPath)) return {}
+  const overrides = {}
+  let inOverrides = false
+  for (const line of fs.readFileSync(yamlPath, 'utf8').split('\n')) {
+    if (/^overrides:\s*$/.test(line)) {
+      inOverrides = true
+      continue
+    }
+    if (!inOverrides) continue
+    if (/^\S/.test(line)) break
+    const match = line.match(/^  ([^:]+):\s*(.+?)\s*$/)
+    if (match) {
+      const key = unquoteYamlScalar(match[1].trim())
+      const value = unquoteYamlScalar(match[2].trim())
+      overrides[key] = value
+    }
+  }
+  return overrides
+}
+
+export function collectOverrides(cwd = process.cwd()) {
+  const overrides = {}
+  const packageJsonPath = path.join(cwd, 'package.json')
+  if (fs.existsSync(packageJsonPath)) {
+    const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
+    Object.assign(overrides, pkg.overrides ?? {})
+    Object.assign(overrides, pkg.pnpm?.overrides ?? {})
+  }
+  Object.assign(overrides, readWorkspaceOverrides(path.join(cwd, 'pnpm-workspace.yaml')))
+  return overrides
+}
+
+export function collectOverrideChanges(before, after) {
+  const changed = []
+  const keys = new Set([...Object.keys(before), ...Object.keys(after)])
+  for (const key of keys) {
+    const from = before[key]
+    const to = after[key]
+    if (from !== to) {
+      changed.push({ key, name: getOverridePackageName(key), from, to })
+    }
+  }
+  return changed
+}
+
+export function formatOverrideValue(value) {
+  return value ?? '(removed)'
+}
+
+export function buildOverrideCommitMessage(changed) {
+  if (changed.length === 1) {
+    const only = changed[0]
+    if (only.to === undefined) {
+      return { subject: `vuln(${only.name}): prune override`, body: '' }
+    }
+    return { subject: `vuln(${only.name}): override ${only.to}`, body: '' }
+  }
+
+  const body = changed
+    .map((item) => `- ${item.name}: ${item.from ?? '(missing)'} -> ${formatOverrideValue(item.to)}`)
+    .join('\n')
+  return { subject: `vuln(): override ${changed.length} packages`, body }
+}

package/scripts/policy-upgrade-commit.mjs

@@ -4,15 +4,33 @@
  *
  * Usage:
  *   pnpm exec fg-devkit policy-upgrade-commit [ncu-args...]
+ *   pnpm exec fg-devkit policy-upgrade-commit --prune-overrides [ncu-args...]
  */
 
 import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { createRequire } from 'node:module'
+import { fileURLToPath } from 'node:url'
+import {
+  buildOverrideCommitMessage,
+  collectOverrideChanges,
+  collectOverrides,
+  formatOverrideValue,
+} from './override-changes.mjs'
 
 const require = createRequire(import.meta.url)
-const packageJsonPath = path.join(process.cwd(), 'package.json')
+const cwd = process.cwd()
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const packageJsonPath = path.join(cwd, 'package.json')
+const PRUNE_FLAG = '--prune-overrides'
+
+function splitArgs(argv) {
+  return {
+    pruneOverrides: argv.includes(PRUNE_FLAG),
+    ncuArgs: argv.filter((arg) => arg !== PRUNE_FLAG),
+  }
+}
 
 function runNcu(args = []) {
   let ncuBin
@@ -31,7 +49,7 @@ function runNcu(args = []) {
 
   const result = spawnSync(process.execPath, [ncuBin, ...effectiveArgs], {
     stdio: 'inherit',
-    cwd: process.cwd(),
+    cwd,
     env: process.env,
   })
   if (result.error) {
@@ -44,7 +62,21 @@ function runNcu(args = []) {
 function runGit(args) {
   const result = spawnSync('git', args, {
     stdio: 'inherit',
-    cwd: process.cwd(),
+    cwd,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[policy-upgrade-commit]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function runPruneOverridesFix() {
+  console.log('[policy-upgrade-commit] Pruning overrides that no longer affect pnpm audit…')
+  const result = spawnSync(process.execPath, [path.join(scriptDir, 'prune-overrides.mjs'), '--fix'], {
+    stdio: 'inherit',
+    cwd,
     env: process.env,
   })
   if (result.error) {
@@ -55,7 +87,7 @@ function runGit(args) {
 }
 
 function stageExistingFiles(files) {
-  const existingFiles = files.filter((filePath) => fs.existsSync(path.join(process.cwd(), filePath)))
+  const existingFiles = files.filter((filePath) => fs.existsSync(path.join(cwd, filePath)))
   if (existingFiles.length === 0) return 0
   return runGit(['add', '--', ...existingFiles])
 }
@@ -87,7 +119,6 @@ function collectPackageVersionChanges(beforePackage, afterPackage) {
   return changed
 }
 
-/** ncu can upgrade package.json `packageManager` (e.g. pnpm@x.y.z); treat as one bump. */
 function collectPackageManagerChange(beforePackage, afterPackage) {
   const before = beforePackage.packageManager
   const after = afterPackage.packageManager
@@ -102,12 +133,80 @@ function collectPackageManagerChange(beforePackage, afterPackage) {
   }
 }
 
+function buildCommitMessage(changed) {
+  if (changed.length === 1) {
+    const only = changed[0]
+    return { subject: `dep(${only.name}): bump to ${only.to}`, body: '' }
+  }
+
+  const body = changed.map((item) => `- ${item.name}: ${item.from} -> ${item.to}`).join('\n')
+  return { subject: `dep(): bump ${changed.length} packages`, body }
+}
+
+function commitChanges(prefix, subject, body) {
+  const stageExitCode = stageExistingFiles(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'])
+  if (stageExitCode !== 0) {
+    return stageExitCode
+  }
+  console.log(`[${prefix}] Auto-committing: ${subject}`)
+  if (body) {
+    console.log(body)
+  }
+  const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
+  return runGit(commitArgs)
+}
+
+function pruneAndCommitOverrides() {
+  let beforeOverrides
+  try {
+    beforeOverrides = collectOverrides(cwd)
+  } catch (err) {
+    console.error(`[policy-upgrade-commit] Failed to read overrides before prune: ${err.message}`)
+    return 1
+  }
+
+  if (Object.keys(beforeOverrides).length === 0) {
+    console.log('[policy-upgrade-commit] No overrides to prune.')
+    return 0
+  }
+
+  const pruneExitCode = runPruneOverridesFix()
+  if (pruneExitCode !== 0) {
+    return pruneExitCode
+  }
+
+  let afterOverrides
+  try {
+    afterOverrides = collectOverrides(cwd)
+  } catch (err) {
+    console.error(`[policy-upgrade-commit] Failed to read overrides after prune: ${err.message}`)
+    return 1
+  }
+
+  const changed = collectOverrideChanges(beforeOverrides, afterOverrides)
+  if (changed.length === 0) {
+    console.log('[policy-upgrade-commit] No unused overrides to prune.')
+    return 0
+  }
+
+  console.log('[policy-upgrade-commit] Override changes detected:')
+  for (const item of changed) {
+    const fromLabel = item.from ?? '(missing)'
+    console.log(`  - ${item.name}: ${fromLabel} -> ${formatOverrideValue(item.to)}`)
+  }
+
+  const { subject, body } = buildOverrideCommitMessage(changed)
+  return commitChanges('policy-upgrade-commit', subject, body)
+}
+
 function main() {
   if (!fs.existsSync(packageJsonPath)) {
     console.error(`[policy-upgrade-commit] package.json not found at ${packageJsonPath}`)
     process.exit(1)
   }
 
+  const { pruneOverrides, ncuArgs } = splitArgs(process.argv.slice(2))
+
   let beforePackage
   try {
     beforePackage = readJson(packageJsonPath)
@@ -116,7 +215,7 @@ function main() {
     process.exit(1)
   }
 
-  const upgradeExitCode = runNcu(process.argv.slice(2))
+  const upgradeExitCode = runNcu(ncuArgs)
   if (upgradeExitCode !== 0) {
     process.exit(upgradeExitCode)
   }
@@ -137,36 +236,24 @@ function main() {
 
   if (changed.length === 0) {
     console.log('[policy-upgrade-commit] No package version changes detected in package.json.')
-    process.exit(0)
-  }
-
-  console.log('[policy-upgrade-commit] Package version changes detected in package.json:')
-  for (const item of changed) {
-    console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
-  }
+  } else {
+    console.log('[policy-upgrade-commit] Package version changes detected in package.json:')
+    for (const item of changed) {
+      console.log(`  - ${item.name}: ${item.from} -> ${item.to}`)
+    }
 
-  const stageExitCode = stageExistingFiles(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'])
-  if (stageExitCode !== 0) {
-    process.exit(stageExitCode)
+    const { subject, body } = buildCommitMessage(changed)
+    const commitExitCode = commitChanges('policy-upgrade-commit', subject, body)
+    if (commitExitCode !== 0) {
+      process.exit(commitExitCode)
+    }
   }
 
-  const { subject, body } = buildCommitMessage(changed)
-  console.log(`[policy-upgrade-commit] Auto-committing: ${subject}`)
-  if (body) {
-    console.log(body)
-  }
-  const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
-  process.exit(runGit(commitArgs))
-}
-
-function buildCommitMessage(changed) {
-  if (changed.length === 1) {
-    const only = changed[0]
-    return { subject: `dep(${only.name}): bump to ${only.to}`, body: '' }
+  if (!pruneOverrides) {
+    process.exit(0)
   }
 
-  const body = changed.map((item) => `- ${item.name}: ${item.from} -> ${item.to}`).join('\n')
-  return { subject: `dep(): bump ${changed.length} packages`, body }
+  process.exit(pruneAndCommitOverrides())
 }
 
 main()

package/scripts/prune-overrides.mjs

@@ -0,0 +1,340 @@
+#!/usr/bin/env node
+/**
+ * Find pnpm-workspace.yaml overrides that no longer change the audit report.
+ *
+ * Each remaining override is removed in isolation (in a temp copy), the lockfile
+ * is re-resolved, and `pnpm audit --json` is compared to the current remaining
+ * set. That way overlapping rules (e.g. three nodemailer selectors) are not all
+ * dropped just because each is redundant while the others exist.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit prune-overrides           # report only
+ *   pnpm exec fg-devkit prune-overrides --fix     # drop the prunable entries
+ *   pnpm exec fg-devkit prune-overrides --commit  # drop them and auto-commit
+ */
+
+import { mkdtempSync, rmSync, cpSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { parseArgs } from 'node:util'
+import {
+  buildOverrideCommitMessage,
+  collectOverrideChanges,
+  collectOverrides,
+  formatOverrideValue,
+} from './override-changes.mjs'
+
+const ROOT = process.cwd()
+const WORKSPACE_FILE = 'pnpm-workspace.yaml'
+const COPIED_FILES = ['package.json', 'pnpm-lock.yaml', WORKSPACE_FILE, '.npmrc']
+
+const { values: args } = parseArgs({
+  options: {
+    fix: { type: 'boolean', default: false },
+    commit: { type: 'boolean', default: false },
+    help: { type: 'boolean', short: 'h', default: false },
+  },
+  strict: true,
+})
+
+if (args.help) {
+  console.log(`Usage: pnpm exec fg-devkit prune-overrides [--fix] [--commit]
+
+Reports workspace overrides that can be removed without introducing new
+pnpm audit findings. Pass --fix to delete those entries in place.
+Pass --commit to apply the deletions and auto-commit.`)
+  process.exit(0)
+}
+
+const shouldFix = args.fix || args.commit
+
+function runGit(gitArgs) {
+  const result = spawnSync('git', gitArgs, {
+    stdio: 'inherit',
+    cwd: ROOT,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[prune-overrides]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function commitOverrideChanges(beforeOverrides, afterOverrides) {
+  const changed = collectOverrideChanges(beforeOverrides, afterOverrides)
+  if (changed.length === 0) {
+    console.log('[prune-overrides] No override changes to commit.')
+    return 0
+  }
+
+  console.log('[prune-overrides] Override changes detected:')
+  for (const item of changed) {
+    const fromLabel = item.from ?? '(missing)'
+    console.log(`  - ${item.name}: ${fromLabel} -> ${formatOverrideValue(item.to)}`)
+  }
+
+  const files = ['package.json', 'pnpm-lock.yaml', WORKSPACE_FILE].filter((file) =>
+    existsSync(join(ROOT, file)),
+  )
+  if (files.length === 0) {
+    console.error('[prune-overrides] No files to stage.')
+    return 1
+  }
+
+  const stageExitCode = runGit(['add', '--', ...files])
+  if (stageExitCode !== 0) {
+    return stageExitCode
+  }
+
+  const { subject, body } = buildOverrideCommitMessage(changed)
+  console.log(`[prune-overrides] Auto-committing: ${subject}`)
+  if (body) {
+    console.log(body)
+  }
+  const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
+  return runGit(commitArgs)
+}
+
+function runPnpm(cwd, pnpmArgs, { allowFailure = false } = {}) {
+  const result = spawnSync('pnpm', pnpmArgs, {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, CI: 'true' },
+    maxBuffer: 20 * 1024 * 1024,
+  })
+  if (result.error) {
+    throw result.error
+  }
+  if (!allowFailure && result.status !== 0) {
+    const detail = (result.stderr || result.stdout || '').trim()
+    throw new Error(`pnpm ${pnpmArgs.join(' ')} failed (exit ${result.status})\n${detail}`)
+  }
+  return result
+}
+
+function splitYamlSections(text) {
+  const lines = text.split('\n')
+  const preamble = []
+  const sections = []
+  let current = null
+  for (const line of lines) {
+    const isTopLevel =
+      line !== '' &&
+      !line.startsWith(' ') &&
+      !line.startsWith('\t') &&
+      !line.startsWith('#') &&
+      /^[A-Za-z][\w.-]*:/.test(line)
+    if (isTopLevel) {
+      current = { header: line, body: [] }
+      sections.push(current)
+    } else if (current) {
+      current.body.push(line)
+    } else {
+      preamble.push(line)
+    }
+  }
+  return { preamble, sections }
+}
+
+function joinYamlSections({ preamble, sections }) {
+  const chunks = []
+  if (preamble.some((line) => line !== '')) {
+    chunks.push(preamble.join('\n'))
+  }
+  for (const section of sections) {
+    const body = section.body
+    const trimmed = [...body]
+    while (trimmed.length > 0 && trimmed[trimmed.length - 1] === '') {
+      trimmed.pop()
+    }
+    chunks.push([section.header, ...trimmed].join('\n'))
+  }
+  return `${chunks.join('\n')}\n`
+}
+
+function parseOverrideLine(line) {
+  const match = line.match(/^(\s+)(?:"([^"]+)"|'([^']+)'|([^:]+)):\s*(.*?)\s*$/)
+  if (!match) {
+    return null
+  }
+  return { key: match[2] ?? match[3] ?? match[4], value: match[5] }
+}
+
+function readOverrides(workspaceText) {
+  const doc = splitYamlSections(workspaceText)
+  const section = doc.sections.find((item) => item.header.startsWith('overrides:'))
+  if (!section) {
+    return { doc, entries: [] }
+  }
+  const entries = []
+  for (const line of section.body) {
+    if (!line.trim() || line.trim().startsWith('#')) {
+      continue
+    }
+    const parsed = parseOverrideLine(line)
+    if (!parsed) {
+      throw new Error(`cannot parse override line: ${line}`)
+    }
+    entries.push({ ...parsed, line })
+  }
+  return { doc, entries }
+}
+
+function writeOverrides(workspaceText, keepKeys) {
+  const keep = new Set(keepKeys)
+  const { doc, entries } = readOverrides(workspaceText)
+  const sectionIndex = doc.sections.findIndex((item) => item.header.startsWith('overrides:'))
+  if (sectionIndex === -1) {
+    return workspaceText
+  }
+  const kept = entries.filter((entry) => keep.has(entry.key))
+  if (kept.length === 0) {
+    doc.sections.splice(sectionIndex, 1)
+  } else {
+    doc.sections[sectionIndex].body = kept.map((entry) => entry.line)
+  }
+  return joinYamlSections(doc)
+}
+
+function advisoryIds(report) {
+  const ids = new Set()
+  if (report?.advisories && typeof report.advisories === 'object') {
+    for (const [key, advisory] of Object.entries(report.advisories)) {
+      ids.add(advisory?.github_advisory_id || advisory?.id || key)
+    }
+  }
+  return ids
+}
+
+function parseAuditJson(stdout) {
+  const text = stdout.trim()
+  try {
+    return JSON.parse(text)
+  } catch {
+    const start = text.indexOf('{')
+    const end = text.lastIndexOf('}')
+    if (start >= 0 && end > start) {
+      return JSON.parse(text.slice(start, end + 1))
+    }
+    throw new Error(`pnpm audit --json did not return JSON\n${text.slice(0, 500)}`)
+  }
+}
+
+function auditProject(cwd) {
+  const result = runPnpm(cwd, ['audit', '--json'], { allowFailure: true })
+  if (result.status !== 0 && result.status !== 1) {
+    throw new Error(
+      `pnpm audit failed (exit ${result.status})\n${(result.stderr || result.stdout || '').trim()}`,
+    )
+  }
+  return advisoryIds(parseAuditJson(result.stdout))
+}
+
+function copyProject(dest) {
+  for (const file of COPIED_FILES) {
+    const from = join(ROOT, file)
+    if (existsSync(from)) {
+      cpSync(from, join(dest, file))
+    }
+  }
+}
+
+function resolveAndAudit(tempDir, workspaceText) {
+  writeFileSync(join(tempDir, WORKSPACE_FILE), workspaceText)
+  cpSync(join(ROOT, 'pnpm-lock.yaml'), join(tempDir, 'pnpm-lock.yaml'))
+  runPnpm(tempDir, ['install', '--lockfile-only', '--ignore-scripts', '--no-frozen-lockfile'])
+  return auditProject(tempDir)
+}
+
+function formatIds(ids) {
+  return [...ids].sort().join(', ')
+}
+
+function main() {
+  const workspacePath = join(ROOT, WORKSPACE_FILE)
+  if (!existsSync(workspacePath)) {
+    console.log('No pnpm-workspace.yaml.')
+    return 0
+  }
+
+  const original = readFileSync(workspacePath, 'utf8')
+  const { entries } = readOverrides(original)
+  if (entries.length === 0) {
+    console.log('No overrides in pnpm-workspace.yaml.')
+    return 0
+  }
+
+  if (!existsSync(join(ROOT, 'pnpm-lock.yaml'))) {
+    throw new Error('pnpm-lock.yaml not found')
+  }
+
+  const tempDir = mkdtempSync(join(tmpdir(), 'prune-overrides-'))
+  try {
+    copyProject(tempDir)
+    console.log(`Checking ${entries.length} override(s) against pnpm audit…`)
+    const remaining = new Map(entries.map((entry) => [entry.key, entry]))
+    const prunable = []
+    let baseline = resolveAndAudit(tempDir, writeOverrides(original, remaining.keys()))
+
+    let index = 0
+    for (const entry of entries) {
+      index += 1
+      const trialKeys = [...remaining.keys()].filter((key) => key !== entry.key)
+      process.stdout.write(`[${index}/${entries.length}] ${entry.key} … `)
+      try {
+        const trial = resolveAndAudit(tempDir, writeOverrides(original, trialKeys))
+        const introduced = [...trial].filter((id) => !baseline.has(id))
+        if (introduced.length > 0) {
+          console.log(`KEEP (new: ${formatIds(introduced)})`)
+        } else {
+          remaining.delete(entry.key)
+          prunable.push(entry.key)
+          baseline = trial
+          console.log('PRUNE')
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message.split('\n')[0] : String(error)
+        console.log(`KEEP (${message})`)
+      }
+    }
+
+    console.log('')
+    if (prunable.length === 0) {
+      console.log('Every override still affects the audit report.')
+      return 0
+    }
+
+    console.log(`Prunable (${prunable.length}):`)
+    for (const key of prunable) {
+      console.log(`  - ${key}`)
+    }
+
+    if (!shouldFix) {
+      console.log('\nRe-run with --fix to remove them, or --commit to remove and auto-commit.')
+      return 0
+    }
+
+    const beforeOverrides = collectOverrides(ROOT)
+    writeFileSync(workspacePath, writeOverrides(original, remaining.keys()))
+    console.log('\nUpdated pnpm-workspace.yaml. Refreshing lockfile…')
+    runPnpm(ROOT, ['install', '--no-frozen-lockfile', '--ignore-scripts'])
+
+    if (!args.commit) {
+      console.log('Done.')
+      return 0
+    }
+
+    return commitOverrideChanges(beforeOverrides, collectOverrides(ROOT))
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true })
+  }
+}
+
+try {
+  process.exit(main())
+} catch (error) {
+  console.error(error instanceof Error ? error.message : error)
+  process.exit(2)
+}