Upgrade automation and preparation for 4.2.2

[boardend]

Updates the toolchain and dependencies for QGIS 4.2.2 while introducing automated engine and npm dependency updates.

Changes:

• Upgrades QGIS, vcpkg, Node, pnpm, Vite, OpenLayers, and related dependencies
• Migrates Vite configurations to current ESM conventions
• Adds update workflows, scripts, caching, and operational documentation

[Copilot]

🟡 Changes recommended

The automation has security, duplicate-build, coordinated-pin, and runtime-type alignment issues that should be resolved first.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the toolchain and dependencies for QGIS 4.2.2 while introducing automated engine and npm dependency updates.

Changes:

• Upgrades QGIS, vcpkg, Node, pnpm, Vite, OpenLayers, and related dependencies.
• Migrates Vite configurations to current ESM conventions.
• Adds update workflows, scripts, caching, and operational documentation.

File summaries

File	Description
package.json	Updates engines and root tooling.
pnpm-lock.yaml	Resolves upgraded dependencies.
pnpm-workspace.yaml	Adds release-age exceptions.
.nvmrc	Pins Node 24.20.0.
.gitignore	Ignores CLAUDE.md.
CHANGELOG.md	Prepares 4.2.2 notes.
.github/workflows/build.yml	Expands CI and caching.
.github/workflows/update-engines.yml	Automates engine updates.
.github/workflows/update-deps.yml	Automates npm updates.
build/update/engines.json	Defines engine strategies.
build/update/check.mjs	Detects engine releases.
build/update/apply.mjs	Applies coordinated updates.
docs/engine-updates.md	Documents engine automation.
docs/dependency-updates.md	Documents dependency automation.
build/vcpkg-ports/qgis/vcpkg.json	Updates QGIS port metadata.
build/vcpkg-ports/qgis/portfile.cmake	Pins QGIS 4.2.2 source.
build/vcpkg-ports/libspatialindex/portfile.cmake	Documents version constraint.
build/vite/QgisRuntimePlugin.ts	Updates ESM imports.
build/vite/DirectoryListingPlugin.ts	Uses source type imports.
build/vite/CrossOriginIsolationPlugin.ts	Updates ESM import.
build/vite/ContentSecurityPolicyPlugin.ts	Updates ESM import.
packages/qgis-js/package.json	Updates package tooling.
packages/qgis-js/vite.config.ts	Migrates Vite configuration.
packages/qgis-js-utils/package.json	Updates package tooling.
packages/qgis-js-utils/vite.config.ts	Uses ESM directory metadata.
packages/qgis-js-ol/package.json	Updates package tooling.
packages/qgis-js-ol/vite.config.ts	Uses ESM directory metadata.
sites/dev/package.json	Updates development dependencies.
sites/dev/vite.config.ts	Migrates development-site config.
sites/performance/package.json	Updates performance tooling.
sites/performance/vite.config.ts	Migrates performance config.
docs/examples/qgis-js-example-api/package.json	Updates Vite.
docs/examples/qgis-js-example-digitize/package.json	Updates Vite and OpenLayers.
docs/examples/qgis-js-example-features/package.json	Updates Vite and OpenLayers.
docs/examples/qgis-js-example-ol/package.json	Updates Vite and OpenLayers.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 34/36 changed files
• Comments generated: 16
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.