Evaluate major dependency upgrades (Q3 2026 batch)

[NicolasDeNigris91]

After merging #43 (ajv scope) and #44 (OTel + protobufjs), the
production audit is at found 0 vulnerabilities. The remaining
open Dependabot PRs are all major-version bumps that need
individual evaluation rather than auto-merge. Tracking them here
so the queue stays visible and intentional rather than red noise.

Backend production deps (highest blast radius)

• deps(backend)(deps): bump express from 4.22.2 to 5.2.1 in /backend #30 — express 4 → 5 — major rewrite. Async error handling,
  body-parser split, removed req.param. Touch every route
  handler. Should be its own day-long migration.
• deps(deps): bump helmet from 7.2.0 to 8.1.0 #40 — helmet 7 → 8 — CSP defaults changed; the per-request
  nonce middleware needs re-verification.
• deps(backend)(deps): bump pino from 9.14.0 to 10.3.1 in /backend #34 — pino 9 → 10 — transport API change. Check
  pino-http compatibility (PR fix(deps): upgrade OpenTelemetry + override protobufjs to clear all production high-severity advisories #44 in nominal config).
• deps(deps): bump express-rate-limit from 7.5.1 to 8.5.1 #41 — express-rate-limit 7 → 8 — store API and headers
  behavior shifted; the fail-open path in our middleware needs
  re-checking.
• deps(backend)(deps): bump puppeteer-core from 23.11.1 to 24.43.1 in /backend #31 — puppeteer-core 23 → 24 — verify the SSRF defense
  hooks (DNS rebinding checks) still apply unchanged.

Frontend production deps

• deps(frontend)(deps): bump next from 15.5.18 to 16.2.6 in /frontend #37 — next 15 → 16 — RSC behavior and routing changes.
  Pair-required with eslint-config-next (deps(frontend)(deps-dev): bump eslint-config-next from 15.5.18 to 16.2.6 in /frontend #32) and
  @next/bundle-analyzer (deps(frontend)(deps-dev): bump @next/bundle-analyzer from 15.5.18 to 16.2.6 in /frontend #27).

Dev tooling — done together because they pair

• deps(frontend)(deps-dev): bump tailwindcss from 3.4.19 to 4.3.0 in /frontend #28 — tailwindcss 3 → 4 — v4 is CSS-first config; affects
  every globals.css and @theme block.
• deps(frontend)(deps-dev): bump eslint from 8.57.1 to 10.3.0 in /frontend #35 — eslint 8 → 10 — flat config migration. This is the
  proper fix that obsoletes the ajv scoped override added in
  fix(deps): scope ajv override so ESLint keeps ajv 6.x #43. Backend already has .eslintrc.cjs, frontend has
  .eslintrc.json; both convert to eslint.config.{js,mjs}.
• deps(frontend)(deps-dev): bump eslint-config-next from 15.5.18 to 16.2.6 in /frontend #32 — eslint-config-next 15 → 16 — pair with deps(frontend)(deps): bump next from 15.5.18 to 16.2.6 in /frontend #37.
• deps(frontend)(deps-dev): bump @next/bundle-analyzer from 15.5.18 to 16.2.6 in /frontend #27 — @next/bundle-analyzer 15 → 16 — pair with deps(frontend)(deps): bump next from 15.5.18 to 16.2.6 in /frontend #37.
• deps(backend)(deps-dev): bump @stryker-mutator/jest-runner from 8.7.1 to 9.6.1 in /backend #36 — @stryker-mutator/jest-runner 8 → 9 — bumps Jest 29
  to 30; check ts-jest compat.
• deps(deps-dev): bump @commitlint/config-conventional from 19.8.1 to 21.0.0 #39 — @commitlint/config-conventional 19 → 21 — low blast
  radius (commit message linting); safe-first candidate.

Infrastructure

• ci(deps): bump the actions group with 10 updates #33 — actions group (10 updates) — currently failing CI.
  actions/checkout@v6 and actions/setup-node@v6 break the
  workflows. Wait for upstream to stabilize or pin lower.
• deps(docker)(deps): bump node from 20-slim to 26-slim in /backend #26 — node 20 → 26 (backend Docker) — six LTS versions in
  one jump. Re-verify Puppeteer worker behavior, BullMQ ESM
  handling.
• deps(docker)(deps): bump node from 20-slim to 26-slim in /frontend #25 — node 20 → 26 (frontend Docker) — pair with deps(docker)(deps): bump node from 20-slim to 26-slim in /backend #26.

Notes

• Don't bulk-merge. Each item above either has a breaking-change
  axis worth a paragraph of testing or is paired with another item.
• The Q3 2026 batch label is a heuristic, not a deadline. Items
  with audit-clean equivalents (no security pressure) can stay
  open for months.
• When ready to revisit, the suggested order is: safe-firsts
  (deps(deps-dev): bump @commitlint/config-conventional from 19.8.1 to 21.0.0 #39, then deps(backend)(deps-dev): bump @stryker-mutator/jest-runner from 8.7.1 to 9.6.1 in /backend #36), then the Next.js triad (deps(frontend)(deps): bump next from 15.5.18 to 16.2.6 in /frontend #37 + deps(frontend)(deps-dev): bump eslint-config-next from 15.5.18 to 16.2.6 in /frontend #32 + deps(frontend)(deps-dev): bump @next/bundle-analyzer from 15.5.18 to 16.2.6 in /frontend #27),
  then the heavier rewrites (express 5, helmet 8, tailwind 4).