chore(deps): dependency sweep, security fix, and Dependabot grouping

[ByteMeBaby]

Clears the open high-severity advisory, brings every patch/minor dependency current, and fixes the Dependabot config that was generating structurally broken update PRs. Supersedes #47, #48, #50, and #51, and repairs the lockfile damage from the already-merged #49.

Five commits, each independently verified, so any one can be reverted without taking the others.

What this changes

b9f7dd0 security, lockfile only. brace-expansion 5.0.7 -> 5.0.9, transitive through eslint > @eslint/config-array > minimatch. GHSA-mh99-v99m-4gvg, high: a crafted brace pattern expands without bound and crashes the process out of memory. Dev-only path, no runtime exposure. Kept separate so a revert of any bump below cannot silently take the security fix with it.

583135c react and react-dom to 19.2.8 in lockstep, plus @types/react 19.2.18 and @types/react-dom 19.2.4. packages/ui keeps its peer range at ^19.0.0.

0d2e0b8 the Radix set plus lucide. All six @radix-ui/* packages move together (react-tabs to 1.1.21), plus lucide-react 1.28.0. Net effect on the lockfile is a deletion of 260 lines, because collapsing duplicate internals outweighs the version bumps.

c6d89c4 dev tooling and API runtime. eslint 10.8.0, typescript-eslint 8.65.0, turbo 2.10.8, @playwright/test 1.62.1, vite 8.2.0, @vitejs/plugin-react 6.0.5, tsx 4.23.4, @types/node 26.1.2, @types/pg 8.20.3, hono 4.12.33, @hono/node-server 2.0.12. tooling/eslint-plugin keeps its eslint peer range at ^10.6.0.

ab404e0 Dependabot grouping. Groups react with react-dom and their types, groups @radix-ui/*, groups @tanstack/*, and groups remaining dev tooling for minor/patch only. Raises open-pull-requests-limit to 10.

Why not just merge the five PRs

Three of them were defective, and the defects came from the config rather than from bad luck.

#48 (react alone) would have failed pnpm test. Its lockfile pins react-dom@19.2.7(react@19.2.8). react-dom asserts exact version equality with react at module load and throws rather than warning, and the guard is compiled into the development client build that jsdom loads as well as every server build. Because react-dom@19.2.7 declares a peer of ^19.2.7, which 19.2.8 satisfies, pnpm reports no peer problem while the runtime contract is broken.

#49 (react-tabs alone) forked the shared Radix internals. Merging it left 12 internal packages at two versions each on main, including two copies of @radix-ui/react-slot (1.3.0 and 1.3.1) while packages/ui/src/components/button.tsx imports Slot directly. Nothing in the four gates detects this. 0d2e0b8 collapses them back to one version each. The other risk on that PR did not land: it was two commits behind and its lockfile predated the Tailwind v4 work, but git's text merge preserved all 50 tailwindcss entries.

#47 (eslint) did not actually fix the advisory the way a hand-applied bump would. eslint 10.8.0 still resolves @eslint/config-array 0.23.5 and minimatch 10.2.5, and minimatch declares brace-expansion: ^5.0.5, so editing the manifest and running pnpm install keeps the vulnerable 5.0.7 locked. Dependabot's lockfile only moved because it regenerates from scratch. Hence the explicit pnpm update in b9f7dd0.

Separately, the default open-pull-requests-limit of 5 was hiding the backlog: 27 packages were outdated while only 5 were visible.

Verification

• pnpm audit: no known vulnerabilities.
• All four gates pass uncached under TURBO_FORCE=true, and pnpm test:e2e passes.
• Every one of the five commits passes pnpm install --frozen-lockfile, so no commit carries a lockfile out of sync with its manifests.
• Zero react@19.2.7 references remain in the lockfile, and react-dom@19.2.8(react@19.2.8) is matched.
• Every shared Radix internal resolves to exactly one version (12 checked before and after).
• SSR smoke test, which no gate covers: the dev server returns 200 with real server-rendered HTML and logs (ssr) connected, with no Incompatible React versions error. This is the exact path chore(deps): bump react from 19.2.7 to 19.2.8 #48 would have broken.
• apps/web/src/routeTree.gen.ts does not drift.

Held back

Majors and the SSR framework, each of which deserves its own verified change: @testing-library/jest-dom 7.0.0, typescript 7.0.2, jsdom 30.0.1, and the @tanstack/react-start and react-router bumps.

Note for whoever merges

Merging this closes #47, #48, #50, and #51 automatically. Do not merge #48 directly in the meantime; it would reintroduce the react/react-dom skew.

The @playwright/test bump needs newer browser binaries, so run pnpm exec playwright install chromium after pulling or pnpm test:e2e fails with a missing executable.