Merge pull request #1184 from MBombeck/deps/production-2026-10-09

chore(deps): weekly production updates, next and zod held back

.github/dependabot.yml

@@ -23,6 +23,30 @@ updates:
         update-types:
           - "patch"
           - "minor"
+    ignore:
+      # zod 4.5 made `z.iso.datetime()` require seconds, so a request carrying
+      # `2026-01-01T06:15Z` that passes today would be refused with a 422 on
+      # every route that validates a timestamp, and 4.6 rewrites nullable and
+      # primitive unions in the generated JSON Schema from `anyOf` to `type`
+      # arrays, which reshapes the OpenAPI document and every MCP tool schema.
+      # Both are contract changes for the web client, the iOS app and MCP
+      # callers, not a routine bump, so the move past 4.4 gets its own change
+      # with the timestamp producers audited. Patch releases on 4.4 still
+      # arrive.
+      - dependency-name: "zod"
+        versions: [">=4.5.0"]
+      # Next 16.4.0 breaks URL state after history traversal: with a sheet
+      # opened through `?doc=`, Back leaves it open, and `[` / `]` sometimes
+      # do not move `?day=`. Reproduced in three end-to-end journeys (3 of 40
+      # repeated runs on 16.4.0, 0 of 80 on 16.3.8 with everything else
+      # equal). 16.3.8 carries every published security fix, so the line
+      # waits for a 16.4 patch; the two packages that move with it wait too.
+      - dependency-name: "next"
+        versions: ["16.4.0"]
+      - dependency-name: "eslint-config-next"
+        versions: ["16.4.0"]
+      - dependency-name: "@next/bundle-analyzer"
+        versions: ["16.4.0"]
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

package.json

@@ -53,22 +53,22 @@
     "mcp:stdio": "npx tsx src/cli/mcp-stdio.ts"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1075.0",
-    "@aws-sdk/lib-storage": "3.1075.0",
+    "@aws-sdk/client-s3": "^3.1146.0",
+    "@aws-sdk/lib-storage": "3.1146.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
     "@hookform/resolvers": "^5.9.1",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@napi-rs/canvas": "1.0.9",
-    "@node-rs/argon2": "^2.1.0",
+    "@napi-rs/canvas": "1.0.10",
+    "@node-rs/argon2": "^2.2.2",
     "@parse/node-apn": "^8.1.0",
     "@prisma/adapter-pg": "^7.10.0",
     "@prisma/client": "^7.10.0",
     "@simplewebauthn/browser": "^14.0.0",
-    "@simplewebauthn/server": "^14.0.2",
-    "@tanstack/react-query": "5.103.2",
-    "@tanstack/react-virtual": "^3.14.12",
+    "@simplewebauthn/server": "^14.0.3",
+    "@tanstack/react-query": "5.104.1",
+    "@tanstack/react-virtual": "^3.14.13",
     "@types/sax": "^1.2.7",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -78,31 +78,31 @@
     "jose": "^6.2.12",
     "jspdf": "^4.2.1",
     "jspdf-autotable": "^5.0.8",
-    "lucide-react": "^1.44.0",
-    "mmdb-lib": "^3.0.2",
+    "lucide-react": "^1.52.0",
+    "mmdb-lib": "^3.0.3",
     "next": "16.3.8",
     "next-themes": "^0.4.6",
-    "nodemailer": "10.0.9",
-    "otpauth": "^9.5.1",
+    "nodemailer": "10.0.15",
+    "otpauth": "^9.5.2",
     "p-limit": "^7.3.3",
-    "pg": "^8.23.0",
-    "pg-boss": "^12.34.0",
+    "pg": "^8.23.1",
+    "pg-boss": "^12.37.1",
     "prisma": "^7.10.0",
     "qrcode": "^1.5.4",
-    "radix-ui": "^1.6.7",
+    "radix-ui": "^1.7.0",
     "react": "19.3.0",
-    "react-day-picker": "^10.0.1",
+    "react-day-picker": "^10.0.2",
     "react-dom": "19.3.0",
-    "react-hook-form": "7.83.0",
+    "react-hook-form": "7.89.0",
     "recharts": "^3.10.1",
     "rrule": "^2.8.1",
     "sax": "^1.6.1",
     "sonner": "^2.0.8",
-    "tailwind-merge": "^3.6.0",
+    "tailwind-merge": "^3.7.0",
     "tesseract.js": "^7.0.0",
     "undici": "^8.11.2",
     "web-push": "^3.6.7",
-    "yaml": "^2.8.4",
+    "yaml": "^2.9.1",
     "zod": "^4.4.3",
     "zod-openapi": "^6.0.2",
     "zxcvbn-typescript": "^5.0.1"

src/lib/jobs/__tests__/job-failures-retention.test.ts

@@ -18,10 +18,10 @@ describe("pg-boss failed-row ledger retention", () => {
     ) as { version: string };
     const plans = readFileSync(join(PG_BOSS_ROOT, "dist/plans.js"), "utf8");
 
-    expect(packageJson.version).toBe("12.34.0");
+    expect(packageJson.version).toBe("12.37.1");
     expect(plans).toContain("retention_seconds: FORTEEN_DAYS");
     expect(plans).toContain("deletion_seconds: SEVEN_DAYS");
-    // 12.34 reads the clock through job_now(), which is pg_catalog.now()
+    // 12.37 reads the clock through job_now(), which is pg_catalog.now()
     // unless a test clock opts in, so the seven-day deletion is unchanged.
     expect(plans).toContain(
       "completed_on + deletion_seconds * interval '1s' < ${schema}.job_now()",