chore(deps): apply pending renovate updates

.beans/bf-gm8t--update-all-pending-renovate-dependencies.md

@@ -0,0 +1,57 @@
+---
+# bf-gm8t
+title: Update all pending Renovate dependencies
+status: in-progress
+type: task
+priority: normal
+created_at: 2026-08-06T17:18:31Z
+updated_at: 2026-08-06T17:30:59Z
+---
+
+Apply all 21 Renovate dashboard updates and run the full CI gate.
+
+## Non-major (lockfile only)
+
+- [x] @tanstack/react-router, dompurify, marked, tsx, @hono/node-server, recharts
+- [x] dev deps: @types/react, @types/react-dom, knip, prettier, typescript-eslint
+
+## Major
+
+- [x] @testing-library/jest-dom v7
+- [x] @types/node v24
+- [x] @vitejs/plugin-react v6
+- [x] cspell v10
+- [x] eslint-plugin-unicorn v73
+- [x] jsdom v30
+- [x] lint-staged v17
+- [x] typescript v6 (v7 blocked, see below)
+- [x] pnpm v11
+- [x] chokidar v5
+- [x] graphql v17
+- [x] zod v4
+- [x] pnpm/action-setup v6.0.10 (SHA-pinned)
+
+## Verification
+
+- [x] Full CI gate (green), plus pnpm build and docker build
+- [x] E2E (60/60)
+
+## Summary of Changes
+
+All 21 dashboard updates applied except TypeScript v7. Full gate, build, docker build and E2E all green.
+
+### Deviations from the dashboard
+
+- **typescript v6.0.3, not v7.** `typescript-eslint@8.66.0` throws at import under TS 7 ("does not support TS 7.0"); TS 7 is the native Go port and typescript-eslint still needs the JS compiler API. TS >=7.1 support tracked at typescript-eslint#10940. TS 6.x is the JS-API line published to bridge this gap.
+- **eslint-plugin-unicorn v73, not v72** — v73 was latest at update time.
+
+### Fallout that needed fixing
+
+- TS 6 dropped automatic `@types/*` inclusion, so `apps/server/tsconfig.json` needs an explicit `"types": ["node"]`. Verified against a minimal repro: TS 5.9 passes, TS 6/7 fail on identical input.
+- TS 6 requires an explicit `rootDir` when emitting (TS5011) — added to the three emitting projects.
+- pnpm 11 stopped reading `pnpm.overrides` from `package.json`. The `lodash` / `brace-expansion` security overrides were silently dropped; moved to `overrides:` in `pnpm-workspace.yaml` and confirmed they reappear in the lockfile.
+- pnpm 11 needs `allowBuilds` declared; set `esbuild` and `unrs-resolver` to `false` to preserve prior behaviour (neither was approved before).
+
+### Open question
+
+`minimumReleaseAgeExclude` in `pnpm-workspace.yaml` is auto-generated by pnpm 11's new release-age gate and pins exact versions, so it will accumulate stale entries as Renovate bumps things. Worth deciding whether to keep the gate or disable it.

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -54,7 +54,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -72,7 +72,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -90,7 +90,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -199,7 +199,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -237,8 +237,12 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
+      # No --with-deps: that shells out to sudo to install system libraries, and
+      # the runners have no passwordless sudo. The libraries are already part of
+      # the runner image; only the browser build itself, which lands in the
+      # user's cache, has to track the pinned Playwright version.
       - name: Install Playwright browser
-        run: pnpm --filter @beans-web/web exec playwright install --with-deps chromium
+        run: pnpm --filter @beans-web/web exec playwright install chromium
 
       - name: Run e2e tests
         run: pnpm --filter @beans-web/web e2e
@@ -260,7 +264,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -278,7 +282,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.gitignore

@@ -15,6 +15,7 @@ build/
 dist/
 .next/
 out/
+*.tsbuildinfo
 
 # Dependencies
 node_modules/

apps/server/package.json

@@ -17,16 +17,16 @@
   },
   "dependencies": {
     "@beans-web/shared": "workspace:*",
-    "@hono/node-server": "^2.0.12",
-    "@t3-oss/env-core": "^0.13.0",
-    "chokidar": "^4.0.0",
-    "hono": "^4.12.34",
-    "tsx": "^4.19.0",
-    "zod": "^3.24.0"
+    "@hono/node-server": "^2.1.0",
+    "@t3-oss/env-core": "^0.13.11",
+    "chokidar": "^5.0.0",
+    "hono": "^4.13.0",
+    "tsx": "^4.23.9",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^4.1.0",
-    "vitest": "^4.1.0"
+    "@types/node": "^24.13.3",
+    "@vitest/coverage-v8": "^4.1.10",
+    "vitest": "^4.1.10"
   }
 }

apps/server/tsconfig.json

@@ -1,5 +1,10 @@
 {
   "extends": "../../tsconfig.base.json",
-  "compilerOptions": { "outDir": "dist", "module": "ES2022" },
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src",
+    "module": "ES2022",
+    "types": ["node"]
+  },
   "include": ["src"]
 }

apps/web/package.json

@@ -18,30 +18,30 @@
   "dependencies": {
     "@beans-web/shared": "workspace:*",
     "@tanstack/react-query": "^5.101.4",
-    "@tanstack/react-router": "^1.170.17",
-    "dompurify": "^3.4.12",
-    "graphql": "^16.10.0",
-    "marked": "^18.0.6",
+    "@tanstack/react-router": "^1.170.21",
+    "dompurify": "^3.4.13",
+    "graphql": "^17.0.2",
+    "marked": "^18.0.9",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
-    "recharts": "^3.9.2"
+    "recharts": "^3.10.1"
   },
   "devDependencies": {
     "@axe-core/playwright": "^4.12.1",
     "@codecov/vite-plugin": "^2.0.1",
     "@graphql-codegen/cli": "^7.2.0",
-    "@graphql-codegen/typescript-operations": "^6.1.2",
-    "@playwright/test": "^1.62.0",
-    "@testing-library/jest-dom": "^6.6.0",
+    "@graphql-codegen/typescript-operations": "^6.1.5",
+    "@playwright/test": "^1.62.1",
+    "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
-    "@testing-library/user-event": "^14.6.1",
-    "@types/react": "^19.1.0",
-    "@types/react-dom": "^19.1.0",
-    "@vitejs/plugin-react": "^4.5.0",
-    "@vitest/coverage-v8": "^4.1.0",
-    "jsdom": "^26.1.0",
-    "knip": "^6.26.0",
-    "vite": "^8.2.0",
-    "vitest": "^4.1.0"
+    "@testing-library/user-event": "^14.6.3",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "@vitejs/plugin-react": "^6.0.5",
+    "@vitest/coverage-v8": "^4.1.10",
+    "jsdom": "^30.0.1",
+    "knip": "^6.32.0",
+    "vite": "^8.2.1",
+    "vitest": "^4.1.10"
   }
 }

apps/web/tsconfig.json

@@ -2,6 +2,7 @@
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "dist",
+    "rootDir": "src",
     "module": "ESNext",
     "lib": ["ES2022", "DOM", "DOM.Iterable"],
     "jsx": "react-jsx"

package.json

@@ -3,7 +3,7 @@
   "version": "0.0.0",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@10.30.1",
+  "packageManager": "pnpm@11.20.0",
   "engines": {
     "node": ">=24"
   },
@@ -27,20 +27,20 @@
   "devDependencies": {
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
-    "@eslint-community/eslint-plugin-eslint-comments": "^4.7.1",
-    "cspell": "^9.0.0",
+    "@eslint-community/eslint-plugin-eslint-comments": "^4.7.2",
+    "cspell": "^10.0.1",
     "eslint": "^10.8.0",
-    "eslint-config-prettier": "^10.0.1",
-    "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-react-hooks": "^7.0.1",
-    "eslint-plugin-react-refresh": "^0.5.2",
-    "eslint-plugin-unicorn": "^63.0.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "eslint-plugin-react-refresh": "^0.5.3",
+    "eslint-plugin-unicorn": "^73.0.0",
     "husky": "^9.1.7",
-    "knip": "^6.26.0",
-    "lint-staged": "^16.4.0",
-    "prettier": "^3.5.3",
-    "typescript": "^5.7.3",
-    "typescript-eslint": "^8.24.1"
+    "knip": "^6.32.0",
+    "lint-staged": "^17.3.0",
+    "prettier": "^3.9.6",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.66.0"
   },
   "lint-staged": {
     "*.{js,jsx,ts,tsx}": [
@@ -51,11 +51,5 @@
       "prettier --write"
     ]
   },
-  "prettier": "./.prettierrc.js",
-  "pnpm": {
-    "overrides": {
-      "lodash": ">=4.18.0",
-      "brace-expansion": ">=5.0.8"
-    }
-  }
+  "prettier": "./.prettierrc.js"
 }

packages/shared/package.json

@@ -19,7 +19,7 @@
     "knip": "knip"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^4.1.0",
-    "vitest": "^4.1.0"
+    "@vitest/coverage-v8": "^4.1.10",
+    "vitest": "^4.1.10"
   }
 }

packages/shared/tsconfig.json

@@ -1,5 +1,5 @@
 {
   "extends": "../../tsconfig.base.json",
-  "compilerOptions": { "outDir": "dist" },
+  "compilerOptions": { "outDir": "dist", "rootDir": "src" },
   "include": ["src"]
 }