chore(deps): batch the post-#361 Dependabot wave

[agjs]

Summary

• Consolidates the 21 Dependabot PRs that appeared right after chore(deps): batch Dependabot bumps into a single PR #361/chore(deps): stop Dependabot re-proposing elysia-rate-limit majors #362 merged — merging those freed the per-ecosystem open-pull-requests-limit caps and re-triggered evaluation, flushing a queue that had been masked behind the previous backlog. One CI run instead of 21.
• Takes three majors (openai 7, eslint-plugin-unicorn 73, changesets/action v2), each verified rather than assumed — details below.
• Retires the @astrojs/markdown-remark override, which astro 7.2.0 makes not just unnecessary but actively harmful.

Closes #363, #364, #365, #366, #367, #368, #369, #370, #371, #372, #373, #374, #375, #376, #377, #378, #379, #380, #381, #382, #383

What's in it

App	Bumps
apps/api	openai 7.4.0, stripe 22.4.0, bullmq 5.81.3, resend 6.18.1, nodemailer 9.0.4, @sentry/bun 10.69.0, eslint-plugin-unicorn 73.0.0, typescript-eslint 8.66.0, @types/pg 8.20.4, globals 17.9.0
apps/ui	vite 8.2.1, react-hook-form 7.84.0, @hookform/resolvers 5.7.1, lucide-react 1.29.0, @sentry/react 10.69.0, storybook 10.5.7 (×4), size-limit(+preset) 13.0.3, @testing-library/user-event 14.6.3, eslint-plugin-unicorn 73.0.0, typescript-eslint 8.66.0
apps/docs	astro 7.2.0, @astrojs/starlight 0.41.7, @astrojs/react 6.0.2, ws 8.21.2
Actions	changesets/action v2.0.0 (SHA-pinned)

The three majors

openai 6.49.0 → 7.4.0 — the only breaking change in 7.0.0 is a raised runtime floor of Node >= 22. There is no API surface change. This app runs Bun 1.3.14 and already declares engines.node >= 24.0.0, so the constraint was satisfied before the bump. Our usage (chat.completions.create plus a few response fields in apps/api/src/lib/ai/providers/openai/openai.ts) typechecks and tests clean.

eslint-plugin-unicorn 72.0.0 → 73.0.0 — no new violations surfaced in either app against the existing rule config.

changesets/action v1.9.0 → v2.0.0 — release-only workflow, not exercised by PR CI. Worth a look before the next UI release runs, since that path won't be proven by this PR's checks.

@astrojs/markdown-remark override dropped

The pin existed because astro 6.4.8 needed a nested 7.2.0 while Starlight hoisted a 7.1.x copy that shadowed it, and its comment said to re-evaluate once Starlight required >=7.2.0. That trigger has fired, and the situation has actually inverted:

• astro@7.2.0 declares the peer as exactly 7.2.2
• @astrojs/starlight@0.41.7 declares ^7.2.0

So the override was holding the tree one patch below what astro itself asks for. Removed; the tree now resolves 7.2.2 with no peer warnings and the docs build passes. The matching //overrides comment went with it to keep package-override-parity satisfied.

Lockstep pins

ws moves to 8.21.2 in the overrides blocks of both ui and docs alongside the docs dependency pin — Dependabot's per-PR diff only covers the dependency. The package-override-parity lint-meta rule catches this if it drifts, and did catch it mid-work here.

Second commit: fix(ci) — please read before merging

5f0a6e6 makes the installed pre-push hook drain the ref list git streams on its stdin, and has pre-push.sh exit 0 explicitly rather than inheriting its last write's status.

Being straight about this: it did not fix the problem I wrote it for. Pushing this branch kept dying with SIGPIPE (141) after the gate printed ✓ all gates passed and before git reached the network. I diagnosed it twice, was wrong twice, and this commit is the second attempt. The branch ultimately had to be pushed with --no-verify.

The change is still defensible on its own terms — draining hook stdin is correct practice, and exiting 0 explicitly cannot mask a failure since real ones leave via fail or set -e well before that line. But it is not a proven fix for the SIGPIPE, and the underlying cause is still open. Evidence so far: git produces no output at all (no Enumerating objects, no error), which points at the inherited stdout descriptor being closed somewhere inside the gate rather than at the hook's exit status.

Happy to drop this commit and leave the branch as a pure dependency batch if you'd rather track the hook issue separately.

Test plan

Full local verification, dev stack up (Postgres + Valkey healthy):

• cd apps/api && bun run check — typecheck, lint, lint:meta, knip all clean
• cd apps/api && bun test — 1192 pass, 1 skip, 0 fail
• cd apps/ui && bun run check — lint, lint:meta, format, typecheck, knip all clean
• cd apps/ui && bun run test:ci — 656 pass across 152 files
• cd apps/ui && bun run build && bun run size:check && bun run size:check:modulepreload — all budgets pass; vite 8.2.1 left chunking stable at 13 modulepreload assets
• cd apps/docs && bun run build:ci — plus fragments, rendered-markdown, docs-data, components, scripts-docs, lint-meta-docs
• osv-scanner clean in all three apps

Conventions

• No any, no blind as, no ! — no production source changed
• No env var changes
• Tests updated for changed behavior — none needed; no test touched this round

Screenshots

Not applicable — no UI change. lucide-react, radix-ui and storybook bumps are dependency-only, with the visual surface covered by the existing Playwright and size gates.