build(deps): batch Dependabot updates, patch undici CVEs, clean up pnpm overrides

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
     name: Migration Drift Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - name: Check for schema drift
         run: pnpm exec prisma migrate diff --from-schema-datamodel
@@ -30,7 +30,7 @@ jobs:
     name: Lint & Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/turbo-cache
       - name: Build internal packages
@@ -46,7 +46,7 @@ jobs:
     name: Type Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/turbo-cache
       - name: Build internal packages
@@ -58,7 +58,7 @@ jobs:
     name: Security Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - name: Audit dependencies
         run: pnpm audit --audit-level=moderate
@@ -84,7 +84,7 @@ jobs:
           --health-cmd pg_isready --health-interval 10s --health-timeout 5s
           --health-retries 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-node
       - uses: ./.github/actions/turbo-cache
       - name: Build internal packages

.github/workflows/codeql.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-node
 

.github/workflows/prisma-migrate-master.yml

@@ -18,7 +18,7 @@ jobs:
     name: Apply Prisma migrations to Supabase
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-node
 

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

apps/api/Dockerfile

@@ -2,8 +2,8 @@ FROM node:24-alpine AS base
 WORKDIR /app
 RUN npm install -g npm@latest && \
     mkdir -p /tmp/patch && cd /tmp/patch && npm init -y && \
-    npm install brace-expansion@^5.0.6 && \
-    cp -r node_modules/brace-expansion /usr/local/lib/node_modules/npm/node_modules/ && \
+    npm install brace-expansion@^5.0.6 undici@^6.27.0 && \
+    cp -r node_modules/brace-expansion node_modules/undici /usr/local/lib/node_modules/npm/node_modules/ && \
     rm -rf /tmp/patch
 COPY package.json /tmp/package.json
 RUN corepack enable && \
@@ -43,8 +43,8 @@ FROM node:24-alpine AS runner
 WORKDIR /app
 RUN npm install -g npm@latest && \
     mkdir -p /tmp/patch && cd /tmp/patch && npm init -y && \
-    npm install brace-expansion@^5.0.6 && \
-    cp -r node_modules/brace-expansion /usr/local/lib/node_modules/npm/node_modules/ && \
+    npm install brace-expansion@^5.0.6 undici@^6.27.0 && \
+    cp -r node_modules/brace-expansion node_modules/undici /usr/local/lib/node_modules/npm/node_modules/ && \
     rm -rf /tmp/patch
 
 ENV NODE_ENV=production

apps/api/package.json

@@ -67,16 +67,16 @@
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
     "express-rate-limit": "^8.5.1",
-    "google-auth-library": "^10.7.0",
+    "google-auth-library": "^10.9.0",
     "helmet": "^8.2.0",
-    "ioredis": "5.10.1",
+    "ioredis": "5.11.1",
     "jsonwebtoken": "^9.0.2",
-    "mongoose": "9.6.3",
-    "openai": "^6.42.0",
+    "mongoose": "9.7.2",
+    "openai": "^6.45.0",
     "pino": "10.3.1",
     "prisma": "^6.19.3",
     "rate-limit-redis": "5.0.0",
-    "stripe": "^22.2.1",
+    "stripe": "^22.3.0",
     "swagger-jsdoc": "^6.3.0",
     "swagger-ui-express": "^5.0.1",
     "zod": "^4.3.6"
@@ -93,10 +93,10 @@
     "@types/supertest": "^7.2.0",
     "@types/swagger-jsdoc": "^6.0.4",
     "@types/swagger-ui-express": "^4.1.8",
-    "concurrently": "^9.2.1",
+    "concurrently": "^10.0.3",
     "dotenv-cli": "^11.0.0",
     "jest": "^29.7.0",
-    "nock": "^14.0.11",
+    "nock": "^14.0.16",
     "nodemon": "^3.1.10",
     "pino-pretty": "13.1.3",
     "rimraf": "^6.0.1",

apps/bot/Dockerfile

@@ -2,8 +2,8 @@ FROM node:24-alpine AS base
 WORKDIR /app
 RUN npm install -g npm@latest && \
     mkdir -p /tmp/patch && cd /tmp/patch && npm init -y && \
-    npm install brace-expansion@^5.0.6 && \
-    cp -r node_modules/brace-expansion /usr/local/lib/node_modules/npm/node_modules/ && \
+    npm install brace-expansion@^5.0.6 undici@^6.27.0 && \
+    cp -r node_modules/brace-expansion node_modules/undici /usr/local/lib/node_modules/npm/node_modules/ && \
     rm -rf /tmp/patch
 COPY package.json /tmp/package.json
 RUN corepack enable && \
@@ -40,8 +40,8 @@ FROM node:24-alpine AS runner
 WORKDIR /app
 RUN npm install -g npm@latest && \
     mkdir -p /tmp/patch && cd /tmp/patch && npm init -y && \
-    npm install brace-expansion@^5.0.6 && \
-    cp -r node_modules/brace-expansion /usr/local/lib/node_modules/npm/node_modules/ && \
+    npm install brace-expansion@^5.0.6 undici@^6.27.0 && \
+    cp -r node_modules/brace-expansion node_modules/undici /usr/local/lib/node_modules/npm/node_modules/ && \
     rm -rf /tmp/patch
 
 ENV NODE_ENV=production

apps/bot/package.json

@@ -37,13 +37,13 @@
     "@grammyjs/conversations": "^2.1.0",
     "dotenv": "^17.4.2",
     "grammy": "^1.44.0",
-    "ioredis": "5.10.1",
+    "ioredis": "5.11.1",
     "pino": "10.3.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",
     "@types/node": "^24.3.1",
-    "concurrently": "^9.2.1",
+    "concurrently": "^10.0.3",
     "dotenv-cli": "^11.0.0",
     "jest": "^29.7.0",
     "nodemon": "^3.1.10",

apps/web/Dockerfile

@@ -2,8 +2,8 @@ FROM node:24-alpine AS base
 WORKDIR /app
 RUN npm install -g npm@latest && \
     mkdir -p /tmp/patch && cd /tmp/patch && npm init -y && \
-    npm install brace-expansion@^5.0.6 && \
-    cp -r node_modules/brace-expansion /usr/local/lib/node_modules/npm/node_modules/ && \
+    npm install brace-expansion@^5.0.6 undici@^6.27.0 && \
+    cp -r node_modules/brace-expansion node_modules/undici /usr/local/lib/node_modules/npm/node_modules/ && \
     rm -rf /tmp/patch
 COPY package.json /tmp/package.json
 RUN corepack enable && \
@@ -43,8 +43,8 @@ FROM node:24-alpine AS runner
 WORKDIR /app
 RUN npm install -g npm@latest && \
     mkdir -p /tmp/patch && cd /tmp/patch && npm init -y && \
-    npm install brace-expansion@^5.0.6 && \
-    cp -r node_modules/brace-expansion /usr/local/lib/node_modules/npm/node_modules/ && \
+    npm install brace-expansion@^5.0.6 undici@^6.27.0 && \
+    cp -r node_modules/brace-expansion node_modules/undici /usr/local/lib/node_modules/npm/node_modules/ && \
     rm -rf /tmp/patch
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1

apps/web/package.json

@@ -17,12 +17,12 @@
   "dependencies": {
     "@auth/prisma-adapter": "^2.11.1",
     "@fintrack/types": "workspace:*",
-    "@tanstack/react-query": "^5.101.0",
-    "@tanstack/react-query-devtools": "^5.101.0",
-    "axios": "^1.17.0",
+    "@tanstack/react-query": "^5.101.1",
+    "@tanstack/react-query-devtools": "^5.101.1",
+    "axios": "^1.18.1",
     "chart.js": "^4.5.0",
-    "framer-motion": "^12.40.0",
-    "i18next": "^26.3.1",
+    "framer-motion": "^12.42.0",
+    "i18next": "^26.3.3",
     "i18next-browser-languagedetector": "^8.2.1",
     "leaflet": "^1.9.4",
     "next": "^16.2.9",
@@ -49,14 +49,14 @@
     "@types/node": "^25.5.2",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.1.6",
-    "@vitejs/plugin-react": "^6.0.1",
+    "@vitejs/plugin-react": "^6.0.3",
     "eslint-plugin-react-hooks": "^7.1.1",
-    "globals": "^17.6.0",
+    "globals": "^17.7.0",
     "jsdom": "^29.0.2",
-    "postcss": "^8.5.15",
+    "postcss": "^8.5.16",
     "typescript": "~6.0.3",
-    "typescript-eslint": "^8.61.0",
-    "vite": "^8.0.16",
+    "typescript-eslint": "^8.62.0",
+    "vite": "^8.1.0",
     "vitest": "^4.1.8"
   },
   "optionalDependencies": {

package.json

@@ -121,33 +121,25 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.39.2",
-    "doctoc": "2.4.1",
+    "doctoc": "2.5.0",
     "eslint": "^9.30.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^7.1.1",
-    "globals": "^17.6.0",
+    "globals": "^17.7.0",
     "husky": "^9.1.7",
-    "lint-staged": "^17.0.7",
+    "lint-staged": "^17.0.8",
     "next": "^16.2.9",
     "prettier": "^3.8.4",
-    "turbo": "^2.9.17",
+    "turbo": "^2.10.0",
     "typescript": "6.0.3",
-    "typescript-eslint": "^8.61.0"
+    "typescript-eslint": "^8.62.0"
   },
   "optionalDependencies": {
     "@rolldown/binding-linux-x64-gnu": "*",
     "@rolldown/binding-linux-x64-musl": "*",
-    "@rollup/rollup-linux-x64-gnu": "^4.62.0",
+    "@rollup/rollup-linux-x64-gnu": "^4.62.2",
     "@tailwindcss/oxide-linux-x64-gnu": "*",
     "lightningcss-linux-x64-gnu": "*"
-  },
-  "pnpm": {
-    "overrides": {
-      "shell-quote@<1.8.4": "1.8.4",
-      "uuid@<11.1.1": "11.1.1",
-      "js-yaml@3": "4.2.0",
-      "postcss@<8.5.15": "8.5.15"
-    }
   }
 }