chore(deps): consolidate 12 dependabot PRs (2026-07-26 batch)

[Weegy]

Summary

Consolidates today's 12 open Dependabot PRs into a single branch, applied surgically onto fresh main (not by merging the individual bot branches), with regenerated lockfiles. Follows the same pattern as the prior consolidated batches (#386, #426).

Closes #503, #502, #501, #500, #494, #493, #492, #491, #490, #487, #250

Risk analysis (done before touching anything)

PR	Bump	CI on bot branch	Verdict
#495	typescript 5.9.3 -> 7.0.2	❌ FAILED (build + typecheck + vitest)	Excluded. TS 7 is the new Go-native compiler rewrite (tsgo) — a breaking architectural change, not a routine bump. Added a dependabot ignore rule (typescript, semver-major) so it stops reopening weekly; separate follow-up needed once the ecosystem/tsconfig story for TS7 is validated.
#494	@vitejs/plugin-react 5.2.0 -> 6.0.3	✅	Major version, but CI on the bot branch already exercised the real build/typecheck/lint/vitest against it — included.
#500	actions/setup-node v4 -> v7	✅	3 majors, but CI on the bot branch ran the actual workflow with v7 and passed — included.
#501	actions/setup-python v6 -> v7	✅	Included.
#490	sharp 0.33.5 -> 0.35.3	✅	Native addon bump — build/test green, included.
#250	cytoscape 3.33.4 -> 3.34.0	stale (7-week-old PR, base diverged)	Reapplied the single-line bump onto fresh main instead of merging the stale branch.
#503, #502, #493, #487	grouped dev-tooling / runtime-patch bumps	✅	Low risk (patch/minor), included.
#492, #491	openai, @anthropic-ai/sdk patch/minor	✅	Low risk, included.

Included bumps

middleware

• openai 6.42.0 -> 6.46.0 (chore(deps,middleware)(deps): bump openai from 6.42.0 to 6.46.0 in /middleware #492)
• @anthropic-ai/sdk 0.110.0 -> 0.111.0 (chore(deps,middleware)(deps): bump @anthropic-ai/sdk from 0.111.0 to 0.115.0 in /middleware #491)
• sharp 0.33.5 -> 0.35.3 (chore(deps,middleware)(deps): bump sharp from 0.33.5 to 0.35.3 in /middleware #490)
• ws 8.18.0/8.21.0 -> 8.21.1, bonjour-service 1.4.2 -> 1.4.3 (chore(deps,middleware)(deps): bump the runtime-patches group across 1 directory with 2 updates #502)
• prettier 3.9.4 -> 3.9.5, tsx 4.23.0 -> 4.23.1, vitest 4.1.8/4.1.9 -> 4.1.10 (chore(deps,middleware)(deps-dev): bump the dev-tooling group in /middleware with 3 updates #487)

web-ui

• @tailwindcss/postcss 4.3.2 -> 4.3.3, @types/node 22.20.0 -> 22.20.1, eslint 9.39.4 -> 9.39.5, vitest 4.1.9 -> 4.1.10 (chore(deps,web-ui)(deps-dev): bump the dev-tooling group across 1 directory with 5 updates #503)
• @xyflow/react 12.11.1 -> 12.11.2, next-intl 4.13.1 -> 4.13.2 (chore(deps,web-ui)(deps): bump the runtime-patches group in /web-ui with 2 updates #493)
• @vitejs/plugin-react 5.2.0 -> 6.0.3 -- major, CI-validated (chore(deps,web-ui)(deps-dev): bump @vitejs/plugin-react from 5.2.0 to 6.0.3 in /web-ui #494)
• cytoscape 3.33.4 -> 3.34.0 (chore(deps,web-ui)(deps): bump cytoscape from 3.33.4 to 3.34.0 in /web-ui #250)

ci

• actions/setup-node v4 -> v7 across ci.yml, auto-release.yml, desktop-apps.yml, release.yml (chore(deps,ci): bump actions/setup-node from 4 to 7 #500)
• actions/setup-python v6 -> v7 in desktop-apps.yml (chore(deps,ci): bump actions/setup-python from 6 to 7 #501)

excluded

• typescript 5.9.3 -> 7.0.2 (chore(deps,web-ui)(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /web-ui #495) — see risk analysis above. Added dependabot ignore rule.

Verification

Built/tested locally on Node 22.22.3 (fresh worktree off latest main):

• middleware: full workspace build clean, typecheck clean, lint clean (0 errors). Test suite 4813/4820 pass; the 3 full-suite failures (llmProxy "400 when the body names no model", profilesImportRoute "source-only bundle", routinesTemplateRoute "renders markdown from synthetic raw + slot values") are a pre-existing full-suite-only test-pollution issue (port/connection collision, HTTPParserError) -- all 3 pass 100% in isolation (23/23, 6/6, 12/12), confirming no regression from these bumps. Same category of issue previously documented in chore(deps): consolidate 10 dependabot PRs (2026-07-06 batch) #426.
• web-ui: next build (incl. typecheck) clean, lint 0 errors (36 pre-existing warnings only), i18n:check OK (pre-existing untranslated-string warnings only), vitest run 306/306 pass.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}