chore(deps): aggregate weekly Dependabot batch (api, ui, docs, ci)

.github/workflows/apps-api-release.yml

@@ -39,10 +39,10 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -68,7 +68,7 @@ jobs:
             wud.watch=true
 
       - name: Build and push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: apps/api
           file: apps/api/Dockerfile.prod

.github/workflows/apps-ui-release.yml

@@ -75,10 +75,10 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -104,7 +104,7 @@ jobs:
             wud.watch=true
 
       - name: Build and push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: apps/ui
           file: apps/ui/Dockerfile.prod

.github/workflows/infra-bootstrap-validate.yml

@@ -35,7 +35,7 @@ jobs:
 
       - name: Install OpenTofu
         if: steps.filter.outputs.code == 'true'
-        uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2.0.1
+        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
         with:
           tofu_version: "1.12.0"
           tofu_wrapper: false

.github/workflows/infra-compose-validate-compose.yml

@@ -267,11 +267,11 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.filter.outputs.code == 'true'
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build apps/api prod image
         if: steps.filter.outputs.code == 'true'
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: apps/api
           file: apps/api/Dockerfile.prod
@@ -283,7 +283,7 @@ jobs:
 
       - name: Build apps/ui prod image
         if: steps.filter.outputs.code == 'true'
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: apps/ui
           file: apps/ui/Dockerfile.prod

apps/api/bunfig.toml

@@ -1,13 +1,16 @@
-# Bun config. The `[install]` section is the install-time settings;
+# Bun config. The install table below holds install-time settings;
 # everything else (test, runtime) lives in package.json scripts.
+# NB: keep the literal "[" + "install" + "]" token out of comments — semgrep's
+# generic-mode bun-missing-minimum-release-age rule reads it as a second, empty
+# install table and false-positives despite the real minimumReleaseAge below.
 
 [install]
+minimumReleaseAge = 604800
 # Supply-chain protection. Refuses to install package versions younger than
-# the threshold below, on the theory that a compromised publish gets caught
-# Matches the Bun supply-chain settings on apps/ui
+# the threshold above, on the theory that a compromised publish gets caught
+# before the window elapses. Matches the Bun supply-chain settings on apps/ui
 # and the docs site. Value is in seconds: 604800 = 7 days.
 # https://bun.com/docs/install/lockfile#minimumreleaseage
-minimumReleaseAge = 604800
 # First-party packages we publish ourselves are exempt from the quarantine —
 # we control the release and don't need a 7-day window to catch a compromised
 # upstream.

apps/api/package.json

@@ -50,7 +50,7 @@
     "prepare": "husky 2>/dev/null || true"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "0.105.0",
+    "@anthropic-ai/sdk": "0.106.0",
     "@casl/ability": "7.0.0",
     "@elysiajs/cors": "1.4.2",
     "@elysiajs/jwt": "1.4.2",
@@ -62,10 +62,10 @@
     "@opentelemetry/sdk-node": "0.219.0",
     "@opentelemetry/semantic-conventions": "1.41.1",
     "@sendgrid/mail": "8.1.6",
-    "@sentry/bun": "10.59.0",
+    "@sentry/bun": "10.62.0",
     "@sinclair/typebox": "0.34.49",
     "arctic": "3.7.0",
-    "bullmq": "5.79.1",
+    "bullmq": "5.79.2",
     "dotenv": "17.4.2",
     "drizzle-orm": "0.45.2",
     "elysia": "1.4.29",
@@ -74,14 +74,14 @@
     "handlebars": "4.7.9",
     "ioredis": "5.11.1",
     "nodemailer": "9.0.1",
-    "openai": "6.44.0",
+    "openai": "6.45.0",
     "otpauth": "9.5.1",
-    "pg": "8.21.0",
+    "pg": "8.22.0",
     "pino": "10.3.1",
     "postgres": "3.4.9",
     "prom-client": "15.1.3",
-    "resend": "6.14.0",
-    "stripe": "22.2.2",
+    "resend": "6.16.0",
+    "stripe": "22.3.0",
     "web-push": "3.6.7"
   },
   "devDependencies": {
@@ -110,19 +110,19 @@
     "bun-types": "1.3.14",
     "chokidar": "5.0.0",
     "drizzle-kit": "0.31.10",
-    "eslint": "10.5.0",
+    "eslint": "10.6.0",
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-import": "2.32.0",
     "eslint-plugin-prettier": "5.5.6",
     "eslint-plugin-promise": "7.3.0",
     "eslint-plugin-sonarjs": "4.1.0",
-    "eslint-plugin-unicorn": "68.0.0",
+    "eslint-plugin-unicorn": "69.0.0",
     "globals": "17.6.0",
     "husky": "9.1.7",
-    "knip": "6.16.1",
-    "prettier": "3.8.4",
+    "knip": "6.23.0",
+    "prettier": "3.9.1",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.61.1"
+    "typescript-eslint": "8.62.0"
   },
   "//overrides": {
     "_": "Why these transitive deps are pinned. Keep each entry in sync with the matching `overrides` key — enforced by the package-override-parity lint-meta rule.",

apps/api/src/api/accounts/accounts.types.ts

@@ -16,8 +16,7 @@ export type ActiveMembership = Omit<IAccountMembership, "role"> & {
 };
 
 export type DbOrTx =
-  | typeof db
-  | Parameters<Parameters<typeof db.transaction>[0]>[0];
+  typeof db | Parameters<Parameters<typeof db.transaction>[0]>[0];
 
 export interface IProvisionAfterVerificationInput {
   readonly userId: string;

apps/api/src/api/auth/mfa.types.ts

@@ -38,9 +38,7 @@ export interface IMfaVerifyLockedOut {
  * leaks a Valkey state shape into its response.
  */
 export type IMfaVerifyOutcome =
-  | IMfaVerifyOk
-  | IMfaVerifyFailed
-  | IMfaVerifyLockedOut;
+  IMfaVerifyOk | IMfaVerifyFailed | IMfaVerifyLockedOut;
 
 export interface IMfaChallenge {
   /** Opaque token returned to the SPA. Hex-encoded. */

apps/api/src/clients/postgres/index.ts

@@ -5,8 +5,7 @@ import { logger } from "../../config/logger";
 import * as schema from "./schema";
 
 const buildSslConfig = ():
-  | false
-  | { rejectUnauthorized: boolean; ca?: string } => {
+  false | { rejectUnauthorized: boolean; ca?: string } => {
   if (!env.isProduction) {
     return false;
   }

apps/api/src/lib/acl/acl.types.ts

@@ -46,9 +46,7 @@ export interface IAccountSubject extends ForcedSubject<"Account"> {
 }
 
 export type SubjectInstance =
-  | ITeamMemberSubject
-  | ISiteSubject
-  | IAccountSubject;
+  ITeamMemberSubject | ISiteSubject | IAccountSubject;
 
 /*
  * CASL's `subject(name, obj)` helper returns `obj & ForcedSubject<name>`

apps/api/src/lib/audit-log/audit-log.types.ts

@@ -1,8 +1,7 @@
 import type { AUDIT_ACTIONS } from "./audit-log.constants";
 
 export type AuditAction =
-  | (typeof AUDIT_ACTIONS)[keyof typeof AUDIT_ACTIONS]
-  | (string & {});
+  (typeof AUDIT_ACTIONS)[keyof typeof AUDIT_ACTIONS] | (string & {});
 
 export interface IAuditWriteResult {
   success: boolean;

apps/api/src/lib/email/email.types.ts

@@ -9,11 +9,7 @@ import type { EmailSuppressionReason } from "./suppression.constants";
  */
 
 export type EmailProviderName =
-  | "resend"
-  | "sendgrid"
-  | "cloudflare"
-  | "smtp"
-  | "noop";
+  "resend" | "sendgrid" | "cloudflare" | "smtp" | "noop";
 
 export interface IEmailMessage {
   to: string;

apps/api/src/lib/notifications/dispatch/dispatch-job.types.ts

@@ -17,10 +17,7 @@ export interface IDispatchJob {
 }
 
 export type DispatchOutcome =
-  | "dispatched"
-  | "deduplicated"
-  | "self_action_skipped"
-  | "unknown_event";
+  "dispatched" | "deduplicated" | "self_action_skipped" | "unknown_event";
 
 export interface IDispatchResult {
   outcome: DispatchOutcome;

apps/api/src/templates/email/preview.types.ts

@@ -5,6 +5,4 @@ export interface ITemplateMetadata {
 }
 
 export type ProcessedValue =
-  | string
-  | ProcessedValue[]
-  | { [key: string]: ProcessedValue };
+  string | ProcessedValue[] | { [key: string]: ProcessedValue };