chore(deps): take the weekly production and development updates

Production: the AWS SDK S3 client and lib-storage 3.1152.0, Prisma
(client, adapter-pg, CLI) 7.10.1, TanStack Query 5.104.3 and Virtual
3.14.21, dotenv 18.0.8, jspdf-autotable 5.0.9, lucide-react 1.59.0,
nodemailer 10.1.2, pg-boss 12.38.0, React and React DOM 19.3.1 (still
exact) and undici 8.12.

React 19.3.1 and undici 8.12.2 are security releases. Prisma 7.10.1
stops a nested interactive transaction from leaking its id into a
later top-level one.

pg-boss moves its schema from 45 to 46; the worker applies the
migration on start and the index builds continue in the background.
Its list and delete helpers now page and batch, which touches only the
queue retirement at boot, and that is idempotent. The retention test
pins the installed version, so it moves to 12.38.0 after re-checking
every source line it asserts.

Development: @axe-core/playwright 4.14.0, Playwright 1.64.1, Vitest and
its coverage provider 5.0.5, shadcn 4.22.0. The Stryker runner patch
still applies; it touches the runner's own name join, and 5.0.5 changes
nothing in how Vitest builds a test's full name. axe-core 4.14 turns on
label-content-name-mismatch for the WCAG 2.1 A tag the a11y specs run.

The S3 client is held on the same release as lib-storage rather than
the newest one its range allows, so the two share one SDK core.

Vite gets a floor at 8.1.6 for GHSA-587h-7wmj-h5pm and four sibling
advisories against its dev server and bundled launch-editor. It arrives
only under Vitest and never reaches the image.

The image's separate Prisma CLI install moves with the app tree to
7.10.1, and its dotenv to 18.0.8, which it had trailed by a patch.

Dockerfile

@@ -268,7 +268,7 @@ RUN mkdir -p /opt/prisma-cli && \
     npm pkg set 'overrides.mysql2=^3.22.0' && \
     npm pkg set 'overrides.@hono/node-server=^1.19.15' && \
     npm pkg set 'overrides.valibot=^1.4.2' && \
-    npm install --omit=dev prisma@7.10.0 @prisma/engines@7.10.0 tsx@4.23.1 dotenv@18.0.6 && \
+    npm install --omit=dev prisma@7.10.1 @prisma/engines@7.10.1 tsx@4.23.1 dotenv@18.0.8 && \
     ln -sfn /opt/prisma-cli/node_modules/.bin/tsx /usr/local/bin/healthlog-tsx && \
     ln -sfn /opt/prisma-cli/node_modules/dotenv /app/node_modules/dotenv && \
     ln -sfn /opt/prisma-cli/node_modules/prisma /app/node_modules/prisma && \

package.json

@@ -53,8 +53,8 @@
     "mcp:stdio": "npx tsx src/cli/mcp-stdio.ts"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1150.0",
-    "@aws-sdk/lib-storage": "3.1150.0",
+    "@aws-sdk/client-s3": "^3.1152.0",
+    "@aws-sdk/lib-storage": "3.1152.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
@@ -62,42 +62,42 @@
     "@napi-rs/canvas": "1.0.11",
     "@node-rs/argon2": "^2.2.2",
     "@parse/node-apn": "^8.1.0",
-    "@prisma/adapter-pg": "^7.10.0",
-    "@prisma/client": "^7.10.0",
+    "@prisma/adapter-pg": "^7.10.1",
+    "@prisma/client": "^7.10.1",
     "@simplewebauthn/browser": "^14.0.0",
     "@simplewebauthn/server": "^14.0.3",
-    "@tanstack/react-query": "5.104.2",
-    "@tanstack/react-virtual": "^3.14.17",
+    "@tanstack/react-query": "5.104.3",
+    "@tanstack/react-virtual": "^3.14.21",
     "@types/sax": "^1.2.7",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "date-fns": "^4.4.0",
-    "dotenv": "^18.0.7",
+    "dotenv": "^18.0.8",
     "fflate": "^0.8.3",
     "jose": "^6.2.12",
     "jspdf": "^4.2.1",
-    "jspdf-autotable": "^5.0.8",
-    "lucide-react": "^1.56.0",
+    "jspdf-autotable": "^5.0.9",
+    "lucide-react": "^1.59.0",
     "mmdb-lib": "^3.0.3",
     "next": "16.3.8",
-    "nodemailer": "10.1.0",
+    "nodemailer": "10.1.2",
     "otpauth": "^9.5.2",
     "p-limit": "^7.3.3",
     "pg": "^8.23.1",
-    "pg-boss": "^12.37.1",
-    "prisma": "^7.10.0",
+    "pg-boss": "^12.38.0",
+    "prisma": "^7.10.1",
     "qrcode": "^1.5.4",
     "radix-ui": "^1.8.1",
-    "react": "19.3.0",
+    "react": "19.3.1",
     "react-day-picker": "^10.0.2",
-    "react-dom": "19.3.0",
+    "react-dom": "19.3.1",
     "recharts": "^3.10.1",
     "rrule": "^2.8.1",
     "sax": "^1.6.1",
     "sonner": "^2.0.8",
     "tailwind-merge": "^3.7.0",
     "tesseract.js": "^7.0.0",
-    "undici": "^8.11.2",
+    "undici": "^8.12.2",
     "web-push": "^3.6.7",
     "yaml": "^2.9.1",
     "zod": "^4.6.7",
@@ -105,9 +105,9 @@
     "zxcvbn-typescript": "^5.0.1"
   },
   "devDependencies": {
-    "@axe-core/playwright": "^4.13.0",
+    "@axe-core/playwright": "^4.14.0",
     "@next/bundle-analyzer": "^16.3.8",
-    "@playwright/test": "^1.64.0",
+    "@playwright/test": "^1.64.1",
     "@stryker-mutator/core": "10.0.0",
     "@stryker-mutator/vitest-runner": "10.0.0",
     "@tailwindcss/postcss": "^4",
@@ -120,7 +120,7 @@
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@types/web-push": "^3.6.4",
-    "@vitest/coverage-v8": "^5.0.4",
+    "@vitest/coverage-v8": "^5.0.5",
     "ajv": "^8.20.0",
     "eslint": "^9",
     "eslint-config-next": "16.3.8",
@@ -131,11 +131,11 @@
     "pdfjs-dist": "6.4.299",
     "prettier": "^3.9.10",
     "prettier-plugin-tailwindcss": "^0.8.1",
-    "shadcn": "^4.21.4",
+    "shadcn": "^4.22.0",
     "tailwindcss": "^4",
     "testcontainers": "^12.2.1",
     "tw-animate-css": "^1.4.0",
     "typescript": "^6",
-    "vitest": "^5.0.4"
+    "vitest": "^5.0.5"
   }
 }

pnpm-workspace.yaml

@@ -103,6 +103,13 @@ overrides:
   "brace-expansion@>=4.0.0 <5.0.12": "^5.0.12"
   "undici@>=7.0.0 <7.29.1": "^7.29.1"
 
+  # GHSA-587h-7wmj-h5pm (HIGH), GHSA-rq7h-c2jc-7f22, GHSA-r825-w8mm-5pxw,
+  # GHSA-698v-4r3x-3vcv and GHSA-9jrq-w75r-8gcw: dev-server file serving,
+  # cross-origin middleware and the bundled launch-editor. Vite arrives only
+  # under vitest, never in the image; vitest asks for ^8, so a floor on the
+  # same major moves it and nothing else.
+  "vite@>=8.0.0 <8.1.6": "^8.1.6"
+
 allowBuilds:
   "@prisma/engines": true
   prisma: true

src/lib/jobs/__tests__/job-failures-retention.test.ts

@@ -18,7 +18,7 @@ describe("pg-boss failed-row ledger retention", () => {
     ) as { version: string };
     const plans = readFileSync(join(PG_BOSS_ROOT, "dist/plans.js"), "utf8");
 
-    expect(packageJson.version).toBe("12.37.1");
+    expect(packageJson.version).toBe("12.38.0");
     expect(plans).toContain("retention_seconds: FORTEEN_DAYS");
     expect(plans).toContain("deletion_seconds: SEVEN_DAYS");
     // 12.37 reads the clock through job_now(), which is pg_catalog.now()