chore(deps): batch the post-#361 Dependabot wave

.github/workflows/apps-ui-release.yml

@@ -63,7 +63,7 @@ jobs:
       # build below whether to add a :<semver> tag.
       - name: Create Release Pull Request or publish
         id: changesets
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action@22ccf9aa43179fe9e27dc62e575971d28cce197c # v2.0.0
         with:
           cwd: apps/ui
           version: bunx changeset version

apps/api/package.json

@@ -62,26 +62,26 @@
     "@opentelemetry/sdk-node": "0.220.0",
     "@opentelemetry/semantic-conventions": "1.42.0",
     "@sendgrid/mail": "8.1.6",
-    "@sentry/bun": "10.68.0",
+    "@sentry/bun": "10.69.0",
     "@sinclair/typebox": "0.34.52",
     "arctic": "3.7.0",
-    "bullmq": "5.81.2",
+    "bullmq": "5.81.3",
     "dotenv": "17.4.2",
     "drizzle-orm": "0.45.2",
     "elysia": "1.4.29",
     "elysia-rate-limit": "4.6.2",
     "fs-extra": "11.3.6",
     "handlebars": "4.7.9",
     "ioredis": "5.11.1",
-    "nodemailer": "9.0.3",
-    "openai": "6.49.0",
+    "nodemailer": "9.0.4",
+    "openai": "7.4.0",
     "otpauth": "9.5.1",
     "pg": "8.22.0",
     "pino": "10.3.1",
     "postgres": "3.4.9",
     "prom-client": "15.1.3",
-    "resend": "6.18.0",
-    "stripe": "22.3.2",
+    "resend": "6.18.1",
+    "stripe": "22.4.0",
     "web-push": "3.6.7"
   },
   "devDependencies": {
@@ -105,7 +105,7 @@
     "@eslint/js": "10.0.1",
     "@types/fs-extra": "11.0.4",
     "@types/nodemailer": "8.0.1",
-    "@types/pg": "8.20.0",
+    "@types/pg": "8.20.4",
     "@types/web-push": "3.6.4",
     "bun-types": "1.3.14",
     "chokidar": "5.0.0",
@@ -116,13 +116,13 @@
     "eslint-plugin-prettier": "5.5.6",
     "eslint-plugin-promise": "7.3.0",
     "eslint-plugin-sonarjs": "4.2.0",
-    "eslint-plugin-unicorn": "72.0.0",
-    "globals": "17.7.0",
+    "eslint-plugin-unicorn": "73.0.0",
+    "globals": "17.9.0",
     "husky": "9.1.7",
     "knip": "6.26.0",
     "prettier": "3.9.6",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.65.0"
+    "typescript-eslint": "8.66.0"
   },
   "//overrides": {
     "_": "Why these transitive deps are pinned. Keep each entry in sync with the matching `overrides` key — enforced by the package-override-parity lint-meta rule.",

apps/docs/package.json

@@ -32,11 +32,11 @@
     "a11y": "bash scripts/a11y.sh"
   },
   "dependencies": {
-    "@astrojs/react": "6.0.1",
+    "@astrojs/react": "6.0.2",
     "@astrojs/sitemap": "3.7.3",
-    "@astrojs/starlight": "0.41.4",
+    "@astrojs/starlight": "0.41.7",
     "@tailwindcss/vite": "4.3.3",
-    "astro": "7.1.3",
+    "astro": "7.2.0",
     "astro-mermaid": "2.1.0",
     "clsx": "2.1.1",
     "mermaid": "11.16.1",
@@ -46,7 +46,7 @@
     "remark-gfm": "4.0.1",
     "sharp": "0.35.3",
     "tailwindcss": "4.3.3",
-    "ws": "8.21.1"
+    "ws": "8.21.2"
   },
   "devDependencies": {
     "@axe-core/cli": "4.12.1",
@@ -70,11 +70,9 @@
     "form-data": "Pin patched form-data (GHSA-hmw2-7cc7-3qxx CRLF injection); 4.0.5 is vulnerable, 4.0.6 patches it. Build-time tooling only (wrangler/astro fetches). Mirrors the API app pin. Excluded from the install quarantine while <7 days old.",
     "undici": "Pin patched undici (GHSA-vmh5-mc38-953g TLS cert-validation bypass, GHSA-pr7r-676h-xcf6); 7.29.0 patches it (adds the GHSA-4cwx-7wf7-3272 batch). Build-time tooling only (wrangler/astro fetches). Mirrors the UI app pin. Excluded from the install quarantine while <7 days old.",
     "@types/react": "Match the UI app's @types/react pin so React types resolve identically across apps (@astrojs/react pulls them transitively here).",
-    "@types/react-dom": "Match the UI app's @types/react-dom pin for the same cross-app type parity.",
-    "@astrojs/markdown-remark": "Pin to astro 6.4.8's exact dependency. Starlight depends on the 7.1.x range transitively, but only 7.2.0 exposes the `unified` subpath export that astro 6.4.8's prerender runtime imports; without this the hoisted 7.1.x copy shadows astro's nested 7.2.0 and `astro build` fails. Re-evaluate when Starlight requires >=7.2.0."
+    "@types/react-dom": "Match the UI app's @types/react-dom pin for the same cross-app type parity."
   },
   "overrides": {
-    "@astrojs/markdown-remark": "7.2.0",
     "adm-zip": "0.6.0",
     "axios": "1.18.0",
     "devalue": "5.8.1",
@@ -87,7 +85,7 @@
     "svgo": "4.0.2",
     "tmp": "0.2.7",
     "undici": "7.29.0",
-    "ws": "8.21.1",
+    "ws": "8.21.2",
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.4"
   }

apps/ui/package.json

@@ -59,23 +59,23 @@
   },
   "dependencies": {
     "@casl/ability": "7.0.1",
-    "@hookform/resolvers": "5.4.0",
-    "@sentry/react": "10.68.0",
+    "@hookform/resolvers": "5.7.1",
+    "@sentry/react": "10.69.0",
     "@tanstack/react-query": "5.101.4",
     "@tanstack/react-query-devtools": "5.101.4",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "i18next": "26.3.6",
     "i18next-browser-languagedetector": "8.2.1",
-    "lucide-react": "1.27.0",
+    "lucide-react": "1.29.0",
     "next-themes": "0.4.6",
     "openapi-fetch": "0.17.0",
     "qrcode": "1.5.4",
     "radix-ui": "1.6.7",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-helmet-async": "3.0.0",
-    "react-hook-form": "7.81.0",
+    "react-hook-form": "7.84.0",
     "react-i18next": "17.0.8",
     "react-router-dom": "7.18.2",
     "sonner": "2.0.7",
@@ -100,14 +100,14 @@
     "@lhci/cli": "0.15.1",
     "@playwright/test": "1.62.1",
     "@sentry/vite-plugin": "5.4.0",
-    "@size-limit/preset-app": "13.0.1",
-    "@storybook/addon-a11y": "10.5.4",
-    "@storybook/addon-themes": "10.5.4",
-    "@storybook/react-vite": "10.5.4",
+    "@size-limit/preset-app": "13.0.3",
+    "@storybook/addon-a11y": "10.5.7",
+    "@storybook/addon-themes": "10.5.7",
+    "@storybook/react-vite": "10.5.7",
     "@tailwindcss/vite": "4.3.3",
     "@testing-library/jest-dom": "7.0.0",
     "@testing-library/react": "16.3.2",
-    "@testing-library/user-event": "14.6.1",
+    "@testing-library/user-event": "14.6.3",
     "@trivago/prettier-plugin-sort-imports": "6.0.2",
     "@types/node": "26.1.1",
     "@types/qrcode": "1.5.6",
@@ -125,7 +125,7 @@
     "eslint-plugin-react-hooks": "7.1.1",
     "eslint-plugin-react-refresh": "0.5.3",
     "eslint-plugin-sonarjs": "4.2.0",
-    "eslint-plugin-unicorn": "72.0.0",
+    "eslint-plugin-unicorn": "73.0.0",
     "husky": "9.1.7",
     "jsdom": "30.0.1",
     "knip": "6.26.0",
@@ -134,13 +134,13 @@
     "otpauth": "9.5.1",
     "prettier": "3.9.6",
     "prettier-plugin-tailwindcss": "0.8.1",
-    "size-limit": "13.0.1",
-    "storybook": "10.5.4",
+    "size-limit": "13.0.3",
+    "storybook": "10.5.7",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.1",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.65.0",
-    "vite": "8.1.4",
+    "typescript-eslint": "8.66.0",
+    "vite": "8.2.1",
     "vite-plugin-svgr": "5.2.0",
     "vitest": "4.1.10",
     "yaml": "2.9.0"
@@ -172,6 +172,6 @@
     "react-dom": "19.2.8",
     "tmp": "0.2.7",
     "undici": "7.29.0",
-    "ws": "8.21.1"
+    "ws": "8.21.2"
   }
 }

scripts/ci/install-git-hooks.sh

@@ -33,6 +33,14 @@ HOOK_FILE="$HOOKS_DIR/pre-push"
 cat > "$HOOK_FILE" <<'EOF'
 #!/usr/bin/env bash
 # Auto-installed by scripts/ci/install-git-hooks.sh — fans out to per-app gates.
+
+# Drain the "<local ref> <local sha> <remote ref> <remote sha>" lines git
+# streams on our stdin. The gate below resolves its own range from
+# origin/main and never reads them, and a hook that exits with stdin
+# unread can leave git writing into a closed pipe — the push then aborts
+# on SIGPIPE (141) with every gate reporting success.
+cat >/dev/null
+
 exec "$(git rev-parse --show-toplevel)/scripts/ci/pre-push.sh"
 EOF
 

scripts/ci/pre-push.sh

@@ -139,3 +139,8 @@ if [[ "$RAN_ANY" -eq 0 ]]; then
 fi
 
 ok "Root pre-push fan-out finished"
+
+# Exit 0 explicitly rather than inheriting the status of the last write.
+# Every real failure leaves through `fail` (exit 1) or is aborted by
+# `set -e` well before this line, so this cannot mask a broken gate.
+exit 0