Some checks failed
CI / lint (push) Successful in 34s
Deploy / notebooks (push) Has been skipped
Deploy / zotero (push) Has been skipped
Deploy / docs (push) Has been skipped
Deploy / api (push) Has been skipped
Deploy / mc (push) Has been skipped
Infra CI / notebooks (push) Successful in 8m12s
Infra CI / zotero (push) Successful in 24s
Infra CI / docs (push) Successful in 17s
Infra CI / api (push) Successful in 18s
Infra CI / mc (push) Successful in 21s
Deploy / report (push) Successful in 15s
CI / test (push) Successful in 18m1s
Package Supply Chain / pkg-supply-chain (push) Failing after 51s
Rebuilding the notebooks image at marimo 0.23.13 surfaced two overlay gaps, both fixed without weakening anything: 1. pnpm supply-chain trust. pnpm 10.28+ enables trustPolicy=no-downgrade by default and rejects tailwind-merge@2.6.1 — a legit dcastil backport onto the 2.x line (real git tag) published WITHOUT npm trusted-publisher provenance that 2.6.0 had. Rather than disable the trust check, pin tailwind-merge to 2.6.0 (the last provenance-backed 2.x, satisfies marimo's ^2.6.0) — trust stays ON for every other dependency. Move this and the jotai pin into pnpm-workspace.yaml `overrides` (the location marimo reads; package.json pnpm.overrides is ignored once a workspace file defines overrides — the old jotai pin never applied). 2. lucide-shim. marimo 0.23.13 imports 9 lucide icons our shim didn't export (CircleSlash, Rows2, Columns3, Cookie, Minus, PanelRightClose, PanelRightOpen, ShieldQuestion, StickyNote) — mapped to their tabler equivalents. Complete set, derived by diffing marimo's lucide-react imports against the shim, so no whack-a-mole. Image rebuilt and the notebooks container recreated on 0.23.13 (healthy, serving); mo.ui.altair_chart with multi-field tooltips renders again.