deps: periodic dependency and security updates

[qw-in]

Update dependencies, audit "overrides", and patch resolvable security notices.

#6286 & #6285 were split out

[arcjet-review]

Arcjet Review — 🟡 Medium Risk

Decision: Needs Review

Rationale: This PR is composed entirely of dependency, override, and toolchain pin changes across many workspace package.json files, including removal of numerous root overrides and restoration of scoped minimum-version overrides. The dependency-changes escalation trigger fires. I did not find hardcoded secrets, auth changes, injection risks, or direct application-code security issues in the diff. However, because the changes alter supply-chain controls broadly and no lockfile changes are visible in the provided files changed list, human review should verify the effective dependency graph and confirm the intended security advisory remediation is actually reflected in install resolution.

Summary of Changes

Updates npm from 12.0.1 to 12.0.2 in the pinned action and root packageManager, bumps many devDependencies such as tsdown, framework/tooling packages, and turbo, removes many broad root overrides, and replaces some overrides with scoped minimum-version overrides for cookie, undici, and sharp.

Escalation Triggers

• Dependency Changes: The PR changes many package.json files, including root devDependencies, workspace devDependencies, packageManager, and npm overrides.

Review Focus Areas

• Verify that removing the previous root overrides does not reintroduce vulnerable transitive versions of packages such as svgo, sharp, postcss, nanoid, adm-zip, fast-uri, uuid, @bufbuild/protobuf, or @anthropic-ai/sdk in the effective dependency tree.
  Root overrides are a supply-chain security control; removing them is safe only if direct or transitive dependency constraints now resolve to fixed versions.
• Confirm that the scoped override ranges using ">=" for sharp, cookie, and undici resolve deterministically to reviewed versions in the lockfile/install output.
  Minimum-version override ranges may allow newer unreviewed versions during future installs unless the lockfile and package manager behavior keep resolution deterministic.
• Check whether the repository has a package-lock.json or equivalent lockfile and whether it was intentionally unchanged or excluded from the provided diff.
  Dependency version changes without a corresponding lockfile update can mean installs will not use the versions shown here, or that reviewers cannot verify the actual resolved dependency graph.
• Verify the npm 12.0.2 bump is compatible with the repository's install and workspace tooling in CI.
  Changing the package manager version can affect lockfile format, override resolution, and install behavior.

Notes

Path filtering: 1 file excluded by ignore paths. 38 of 39 files included in review.

_{Review: 4583a932 | Model: openai/gpt-5.5 | Powered by Arcjet Review}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.3.1 ⏵ 16.3.4		+75	+1
	bun-types@​1.3.14 ⏵ 1.4.2	+1		+1
	undici-types@​7.29.0 ⏵ 7.29.1			+1	+2
	rolldown@​1.2.5 ⏵ 1.2.7			+1	+1
	react-router@​8.3.0 ⏵ 8.3.1	+1		+1	-1
	@​sveltejs/​kit@​2.70.2 ⏵ 2.70.3				+1
	vite@​8.2.1 ⏵ 8.2.2			+1
	turbo@​2.10.10 ⏵ 2.10.12	+1
	astro@​7.2.2 ⏵ 7.3.2	+1	+75	+1
	tsdown@​0.22.14 ⏵ 0.23.0			+1
	@​nestjs/​common@​11.2.1 ⏵ 11.2.3				+1
	@​tanstack/​intent@​0.3.8 ⏵ 0.4.0			+1
	fastify@​5.12.1 ⏵ 5.12.3				+1

View full report