fix: revert "chore: bump d3-color and d3" — d3 v7 is ESM-only and crashes the CJS runtime

[vn7n24fzkq]

Production went down (#320): every card endpoint returned FUNCTION_INVOCATION_FAILED. Runtime logs show the crash at module load:

Error [ERR_REQUIRE_ESM]: require() of ES Module /var/task/node_modules/d3/src/index.js
from /var/task/src/templates/card.js not supported.

d3 v7 (and d3-color v3) are ESM-only; this project compiles to CommonJS, so require('d3') throws before any handler runs — the same failure mode as the July d3-color incident (#275). Local tests/tsc/ncc stay green because they resolve modules differently than Vercel's runtime loader, which is why #318 passed CI. The outage shipped inside v0.12.0 and was masked by the 48h CDN window until cached cards expired.

Production is already restored via a hotfix push to release carrying this same revert — this PR reconciles main so the next regular deploy doesn't re-ship the crash.

Also adds .github/dependabot.yml ignoring semver-major updates for d3/d3-color so this class of bump stops arriving until a proper ESM migration is planned.

Refs #320 (left open for monitoring).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added automated weekly maintenance checks to help keep the application’s supporting components current.
  • Updated underlying visualization support for improved compatibility and stability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 31237ab8-e7cc-4c8f-a956-38f008858937

📥 Commits

Reviewing files that changed from the base of the PR and between 2ff1847 and 0db6f83.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• .github/dependabot.yml
• package.json

---

📝 Walkthrough

Walkthrough

The pull request adds weekly Dependabot updates for root-level npm dependencies and excludes major updates for d3 and d3-color. It also changes d3 from version ^7.9.0 to ^6.7.0.

Changes

Dependency updates

Layer / File(s)	Summary
Dependency version and update policy .github/dependabot.yml, package.json	Dependabot checks npm dependencies weekly. Major updates for d3 and d3-color are ignored. The d3 dependency range changes to ^6.7.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency rollback and the CommonJS runtime error caused by the ESM-only d3 v7 release.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch revert-318-d3-esm

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

package.json

Parsing error: ESLint was configured to run on <tsconfigRootDir>/package.json using parserOptions.project: /tsconfig.test.json
The extension for the file (.json) is non-standard. You should add parserOptions.extraFileExtensions to your config.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}