fix: handle dependency update command failures

[Patrick Lafrance (patricklafrance)]

Summary

• Added pnpm override for fast-xml-parser to <5.5.0 — version 5.5.0 was published with a broken local file: dependency (/home/runner/work/fxp-builder) that causes pnpm update to fail in CI
• Updated the dependency update prompt to create a GitHub issue when pnpm update-outdated-deps itself fails (non-zero exit code), instead of silently stopping because no package.json files changed

Fixes the silent failure observed in https://github.com/workleap/wl-web-configs/actions/runs/22907177971

Test plan

• Trigger the update-dependencies workflow manually and verify it completes successfully
• Verify that if pnpm update-outdated-deps fails, an issue is created

🤖 Generated with Claude Code

[pkg-pr-new]

Open in StackBlitz

@workleap/browserslist-config

pnpm add https://pkg.pr.new/@workleap/browserslist-config@401

@workleap/eslint-configs

pnpm add https://pkg.pr.new/@workleap/eslint-configs@401

@workleap/postcss-configs

pnpm add https://pkg.pr.new/@workleap/postcss-configs@401

@workleap/rsbuild-configs

pnpm add https://pkg.pr.new/@workleap/rsbuild-configs@401

@workleap/rslib-configs

pnpm add https://pkg.pr.new/@workleap/rslib-configs@401

@workleap/stylelint-configs

pnpm add https://pkg.pr.new/@workleap/stylelint-configs@401

@workleap/swc-configs

pnpm add https://pkg.pr.new/@workleap/swc-configs@401

@workleap/tsup-configs

pnpm add https://pkg.pr.new/@workleap/tsup-configs@401

@workleap/typescript-configs

pnpm add https://pkg.pr.new/@workleap/typescript-configs@401

@workleap/webpack-configs

pnpm add https://pkg.pr.new/@workleap/webpack-configs@401

commit: 718a58e

[Copilot]

Pull request overview

Adds safeguards to keep the dependency-update automation reliable in CI by pinning away from a known-bad fast-xml-parser release and ensuring failures in the update command are surfaced via a GitHub issue.

Changes:

• Added a pnpm override to prevent resolving fast-xml-parser@5.5.0 (which breaks pnpm update due to an invalid local file: dependency).
• Updated the dependency-update agent prompt to open a GitHub issue when pnpm update-outdated-deps fails (non-zero exit) instead of stopping silently.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
pnpm-lock.yaml	Records the fast-xml-parser override in the lockfile to avoid the broken version during installs/updates.
package.json	Adds pnpm.overrides to enforce the fast-xml-parser constraint at the workspace root.
.github/prompts/update-dependencies.md	Improves automation instructions to create an issue when the update command itself fails.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Repo docs for pnpm overrides recommend defining workspace-wide overrides in pnpm-workspace.yaml rather than package.json. Consider moving this override there to keep all pnpm-specific config centralized (and let the lockfile be derived from it), unless there’s a reason it must live in package.json.