chore(deps): update dependencies across the monorepo

[ilbertt]

Bumps every external dependency in every package.json to its latest release, refreshes stale transitives in the lockfile, and updates the toolchain and CI pins that travel with them.

Direct dependencies

Package	From	To
@biomejs/biome	2.4.13	2.5.11
@commitlint/cli	20.5.2	21.2.2
@commitlint/config-conventional	20.5.0	21.2.2
@commitlint/format	20.5.0	21.2.2
@commitlint/types	20.5.0	21.2.0
@types/bun	1.3.13	1.4.0
turbo	2.9.6	2.10.12
zod (catalog)	4.3.6	4.5.4
bun (packageManager + .bun-version)	1.3.13	1.4.0
ink (pomo)	5.2.1	7.1.1
react (pomo)	18.3.1	19.2.8
@types/react (pomo)	18.3.12	19.2.18
@clack/prompts (scaffold)	0.9.1	1.7.0
vitest (with-vitest)	4.1.5	4.1.11

ink 7 requires react >= 19.2, so react moves with it. bun outdated --filter '*' now reports nothing outstanding except the deliberately-held TypeScript.

Transitive dependencies

bun install only re-resolves specs that changed, so 28 transitives stayed pinned at their old lockfile entries despite their ranges allowing newer releases. bun update moves them — notably vite 7.3.2 → 8.2.2 under vitest, @types/node 25.5.0 → 26.4.0 under bun-types, rollup 4.60.2 → 4.63.1, es-toolkit 1.46.0 → 1.52.0 and ws 8.20.0 → 8.21.3 under ink.

CI actions

actions/checkout v6 → v7 and actions/cache v5 → v6. oven-sh/setup-bun@v2 is already current.

Follow-on fixes the bumps required

• biome config migration. 2.5 deprecates linter.rules.recommended in favour of preset. Applied via biome migrate, then reindented to the repo's 2-space style.
• useAwaitThenable false positive. biome 2.5.x can't see through the void | Promise<void> hook union behind an optional object property, so it flags every await in packages/core/src/testing/run-command.ts as awaiting a non-Promise. Dropping those awaits would stop async hooks being sequenced, so the rule is suppressed at file level with an explanation. Regression landed between 2.5.0 and 2.5.5; direct function-typed params are unaffected, only object properties.
• @clack/prompts 1.x validate signature. Now receives string | undefined, so the scaffold example guards for empty input.
• ink 7 devtools import. ink lazily imports its devtools module, which statically imports the optional react-devtools-core peer. Without splitting, Bun inlines that module and hoists the import to the top level, so every run of the pomo example fails with Cannot find package 'react-devtools-core'. Enabling splitting: true preserves ink's lazy loading.

TypeScript stays on 5.9.3

typescript@7.0.2 is the current latest, and 6.0.3 is also out, but both drop the automatic node_modules/@types inclusion this repo relies on. Under either, every package fails with Cannot find name 'Bun' / Cannot find name 'process' / Cannot find namespace 'NodeJS'; passing --types bun explicitly makes it pass, confirming resolution works but auto-inclusion no longer does.

Moving to TS 6 or 7 needs explicit types configuration across the workspace (and, for @parshjs/codegen, revalidating the compiler-API usage in extractor.ts). That's its own change, not a dependency bump. packages/codegen/pkg/package.json keeps typescript: ^5.9.3 for the same reason.

Verification

• bun check:types — 16/16 tasks pass
• bun run test — 6/6 tasks pass (core, env, files, codegen, with-vitest)
• bun run build — 12/12 tasks pass
• bun check:codestyle — clean
• bun install --frozen-lockfile — clean, as CI runs it
• bun check:commit-message — accepts valid headers, rejects invalid ones
• Runtime smoke tests, re-run after the transitive updates: pomo renders its ink countdown, scaffold writes a project through the clack v1 prompts

Note

bun check:codestyle was verified with !**/.claude in biome.json temporarily scoped to !.claude. This branch was developed in a git worktree under .claude/worktrees/, and that glob matches the worktree's ancestor path, so biome ignores the entire tree and reports "No files were processed". Pre-existing behaviour, reproduces identically on biome 2.4.13, and does not affect CI, which checks out at the repo root.