chore(deps): lock file maintenance

[its-miso]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a routine Renovate lock-file maintenance change: only package-lock.json is modified, package.json (dependency ranges, engines, overrides) is untouched, and every locked version bump is a patch or minor within an already-declared semver range. All CI gates — Lint, Typecheck, Tests, Build, Docker Build, npm audit — pass on the head commit, including a full production-image build on the exact node:24-bookworm-slim host platform.

Change-by-change findings

• package-lock.json — Refresh bumps about 20 packages: esbuild 0.28.1 → 0.28.2 with all platform binaries in lockstep; rolldown 1.2.2 → 1.2.3 with @​oxc-project/types 0.142.0 → 0.143.0; pg 8.22.0 → 8.23.0 with pg-protocol 1.15.0 → 1.16.0 and @​types/pg 8.20.3 → 8.21.0; hono 4.13.0 → 4.13.1 and @​hono/node-server 2.0.12 → 2.1.0; vite 8.2.0 → 8.2.1; tsx 4.23.11 → 4.23.12; postcss 8.5.25 → 8.5.26 with nanoid 3.3.17 → 3.3.18; plus express-rate-limit, ip-address, readdirp, axe-core, browserslist/caniuse-lite and related data packages. No package.json manifest changes, so no new ranges, engines entries, or overrides are introduced.
• Breaking-change check (must_check) — No bump crosses a major version. esbuild 0.28.2 release notes were fetched and describe only bug fixes (TypeScript import-alias tree-shaking, CSS minification of &, input-overwrite regression, top-level await codegen, logical-assignment minification, JS-API deadlock reference counting, duplicated target-engine handling, MP3 MIME detection) with no API/behavior-breaking changes. pg 8.23.0 and @​hono/node-server 2.1.0 are minor bumps within ranges the repo already declared; @​types/pg is a types-only minor.
• Host-platform coupling — The bumped native/toolchain packages (esbuild, rolldown, vite, tsx) run on the Node platform pinned in the Dockerfile (node:24-bookworm-slim) and by engines.node >= 24. Engine ranges recorded in the lockfile for the new versions (esbuild >=18, rolldown ^20.19.0 || >=22.12.0, @​hono/node-server >=20, readdirp >=20.19.0, ip-address >=12) all include Node 24. The CI Docker Build check installed this exact lockfile and ran the production build on that base image successfully — an empirical compatibility check on the host platform.
• Test-suite check (must_check) — CI Tests succeeded, alongside Lint, Typecheck, Build, Docker Build, and npm audit.

Sources

• esbuild v0.28.2 release notes: https://github.com/evanw/esbuild/releases/tag/v0.28.2 (stable patch release, bug fixes only)
• Repository files read: package.json (engines node >=24; dependency ranges unchanged; postcss/sharp overrides preserved) and Dockerfile (node:24-bookworm-slim base image)
• CI status for the head commit: Lint, Typecheck, Tests, Build, Docker Build, npm audit, review — all success

Standards Compliance

• The change touches only the lockfile; no source, Prisma schema, auth, environment-variable, Docker, or workflow conventions are affected.
• The documented postcss and sharp override pins in package.json are left intact, consistent with the repository's advisory-remediation policy ('DO NOT remove without verifying the originating transitive deps have shipped patched versions').
• The npm audit CI check passes, consistent with the repository's security posture.

Unknowns / Needs Verification

• An official Node.js 24 support/compatibility matrix page could not be fetched within the tool budget, so no matrix URL is cited. This is mitigated by (a) engine ranges in the lockfile for every newly locked version, all of which include Node 24, and (b) the CI Docker Build that ran npm ci and built on the exact node:24-bookworm-slim host image with this lockfile. If a citable matrix entry is required before merge, confirm Node 24 support status first (e.g., https://nodejs.org/en/about/previous-releases).
• The Renovate PR-body warning that some dependencies could not be looked up is standard Renovate boilerplate pointing to the dependency dashboard; it does not indicate lockfile inconsistency, since npm ci and the full build/test pipeline passed in CI.

[its-miso]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a routine Renovate lock-file maintenance change: only package-lock.json is modified, package.json (dependency ranges, engines, overrides) is untouched, and every locked version bump is a patch or minor within an already-declared semver range. All CI gates — Lint, Typecheck, Tests, Build, Docker Build, npm audit — pass on the head commit, including a full production-image build on the exact node:24-bookworm-slim host platform.

Change-by-change findings

• package-lock.json — Refresh bumps about 20 packages: esbuild 0.28.1 → 0.28.2 with all platform binaries in lockstep; rolldown 1.2.2 → 1.2.3 with @​oxc-project/types 0.142.0 → 0.143.0; pg 8.22.0 → 8.23.0 with pg-protocol 1.15.0 → 1.16.0 and @​types/pg 8.20.3 → 8.21.0; hono 4.13.0 → 4.13.1 and @​hono/node-server 2.0.12 → 2.1.0; vite 8.2.0 → 8.2.1; tsx 4.23.11 → 4.23.12; postcss 8.5.25 → 8.5.26 with nanoid 3.3.17 → 3.3.18; plus express-rate-limit, ip-address, readdirp, axe-core, browserslist/caniuse-lite and related data packages. No package.json manifest changes, so no new ranges, engines entries, or overrides are introduced.
• Breaking-change check (must_check) — No bump crosses a major version. esbuild 0.28.2 release notes were fetched and describe only bug fixes (TypeScript import-alias tree-shaking, CSS minification of &, input-overwrite regression, top-level await codegen, logical-assignment minification, JS-API deadlock reference counting, duplicated target-engine handling, MP3 MIME detection) with no API/behavior-breaking changes. pg 8.23.0 and @​hono/node-server 2.1.0 are minor bumps within ranges the repo already declared; @​types/pg is a types-only minor.
• Host-platform coupling — The bumped native/toolchain packages (esbuild, rolldown, vite, tsx) run on the Node platform pinned in the Dockerfile (node:24-bookworm-slim) and by engines.node >= 24. Engine ranges recorded in the lockfile for the new versions (esbuild >=18, rolldown ^20.19.0 || >=22.12.0, @​hono/node-server >=20, readdirp >=20.19.0, ip-address >=12) all include Node 24. The CI Docker Build check installed this exact lockfile and ran the production build on that base image successfully — an empirical compatibility check on the host platform.
• Test-suite check (must_check) — CI Tests succeeded, alongside Lint, Typecheck, Build, Docker Build, and npm audit.

Sources

• esbuild v0.28.2 release notes: https://github.com/evanw/esbuild/releases/tag/v0.28.2 (stable patch release, bug fixes only)
• Repository files read: package.json (engines node >=24; dependency ranges unchanged; postcss/sharp overrides preserved) and Dockerfile (node:24-bookworm-slim base image)
• CI status for the head commit: Lint, Typecheck, Tests, Build, Docker Build, npm audit, review — all success

Standards Compliance

• The change touches only the lockfile; no source, Prisma schema, auth, environment-variable, Docker, or workflow conventions are affected.
• The documented postcss and sharp override pins in package.json are left intact, consistent with the repository's advisory-remediation policy ('DO NOT remove without verifying the originating transitive deps have shipped patched versions').
• The npm audit CI check passes, consistent with the repository's security posture.

Unknowns / Needs Verification

• An official Node.js 24 support/compatibility matrix page could not be fetched within the tool budget, so no matrix URL is cited. This is mitigated by (a) engine ranges in the lockfile for every newly locked version, all of which include Node 24, and (b) the CI Docker Build that ran npm ci and built on the exact node:24-bookworm-slim host image with this lockfile. If a citable matrix entry is required before merge, confirm Node 24 support status first (e.g., https://nodejs.org/en/about/previous-releases).
• The Renovate PR-body warning that some dependencies could not be looked up is standard Renovate boilerplate pointing to the dependency dashboard; it does not indicate lockfile inconsistency, since npm ci and the full build/test pipeline passed in CI.

[its-miso]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a routine Renovate lock-file maintenance change: only package-lock.json is modified, package.json (dependency ranges, engines, overrides) is untouched, and every locked version bump is a patch or minor within an already-declared semver range. All CI gates — Lint, Typecheck, Tests, Build, Docker Build, npm audit — pass on the head commit, including a full production-image build on the exact node:24-bookworm-slim host platform.

Change-by-change findings

• package-lock.json — Refresh bumps about 20 packages: esbuild 0.28.1 → 0.28.2 with all platform binaries in lockstep; rolldown 1.2.2 → 1.2.3 with @​oxc-project/types 0.142.0 → 0.143.0; pg 8.22.0 → 8.23.0 with pg-protocol 1.15.0 → 1.16.0 and @​types/pg 8.20.3 → 8.21.0; hono 4.13.0 → 4.13.1 and @​hono/node-server 2.0.12 → 2.1.0; vite 8.2.0 → 8.2.1; tsx 4.23.11 → 4.23.12; postcss 8.5.25 → 8.5.26 with nanoid 3.3.17 → 3.3.18; plus express-rate-limit, ip-address, readdirp, axe-core, browserslist/caniuse-lite and related data packages. No package.json manifest changes, so no new ranges, engines entries, or overrides are introduced.
• Breaking-change check (must_check) — No bump crosses a major version. esbuild 0.28.2 release notes were fetched and describe only bug fixes (TypeScript import-alias tree-shaking, CSS minification of &, input-overwrite regression, top-level await codegen, logical-assignment minification, JS-API deadlock reference counting, duplicated target-engine handling, MP3 MIME detection) with no API/behavior-breaking changes. pg 8.23.0 and @​hono/node-server 2.1.0 are minor bumps within ranges the repo already declared; @​types/pg is a types-only minor.
• Host-platform coupling — The bumped native/toolchain packages (esbuild, rolldown, vite, tsx) run on the Node platform pinned in the Dockerfile (node:24-bookworm-slim) and by engines.node >= 24. Engine ranges recorded in the lockfile for the new versions (esbuild >=18, rolldown ^20.19.0 || >=22.12.0, @​hono/node-server >=20, readdirp >=20.19.0, ip-address >=12) all include Node 24. The CI Docker Build check installed this exact lockfile and ran the production build on that base image successfully — an empirical compatibility check on the host platform.
• Test-suite check (must_check) — CI Tests succeeded, alongside Lint, Typecheck, Build, Docker Build, and npm audit.

Sources

• esbuild v0.28.2 release notes: https://github.com/evanw/esbuild/releases/tag/v0.28.2 (stable patch release, bug fixes only)
• Repository files read: package.json (engines node >=24; dependency ranges unchanged; postcss/sharp overrides preserved) and Dockerfile (node:24-bookworm-slim base image)
• CI status for the head commit: Lint, Typecheck, Tests, Build, Docker Build, npm audit, review — all success

Standards Compliance

• The change touches only the lockfile; no source, Prisma schema, auth, environment-variable, Docker, or workflow conventions are affected.
• The documented postcss and sharp override pins in package.json are left intact, consistent with the repository's advisory-remediation policy ('DO NOT remove without verifying the originating transitive deps have shipped patched versions').
• The npm audit CI check passes, consistent with the repository's security posture.

Unknowns / Needs Verification

• An official Node.js 24 support/compatibility matrix page could not be fetched within the tool budget, so no matrix URL is cited. This is mitigated by (a) engine ranges in the lockfile for every newly locked version, all of which include Node 24, and (b) the CI Docker Build that ran npm ci and built on the exact node:24-bookworm-slim host image with this lockfile. If a citable matrix entry is required before merge, confirm Node 24 support status first (e.g., https://nodejs.org/en/about/previous-releases).
• The Renovate PR-body warning that some dependencies could not be looked up is standard Renovate boilerplate pointing to the dependency dashboard; it does not indicate lockfile inconsistency, since npm ci and the full build/test pipeline passed in CI.

[its-miso]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a routine Renovate lock-file maintenance change: only package-lock.json is modified, package.json (dependency ranges, engines, overrides) is untouched, and every locked version bump is a patch or minor within an already-declared semver range. All CI gates — Lint, Typecheck, Tests, Build, Docker Build, npm audit — pass on the head commit, including a full production-image build on the exact node:24-bookworm-slim host platform.

Change-by-change findings

• package-lock.json — Refresh bumps about 20 packages: esbuild 0.28.1 → 0.28.2 with all platform binaries in lockstep; rolldown 1.2.2 → 1.2.3 with @​oxc-project/types 0.142.0 → 0.143.0; pg 8.22.0 → 8.23.0 with pg-protocol 1.15.0 → 1.16.0 and @​types/pg 8.20.3 → 8.21.0; hono 4.13.0 → 4.13.1 and @​hono/node-server 2.0.12 → 2.1.0; vite 8.2.0 → 8.2.1; tsx 4.23.11 → 4.23.12; postcss 8.5.25 → 8.5.26 with nanoid 3.3.17 → 3.3.18; plus express-rate-limit, ip-address, readdirp, axe-core, browserslist/caniuse-lite and related data packages. No package.json manifest changes, so no new ranges, engines entries, or overrides are introduced.
• Breaking-change check (must_check) — No bump crosses a major version. esbuild 0.28.2 release notes were fetched and describe only bug fixes (TypeScript import-alias tree-shaking, CSS minification of &, input-overwrite regression, top-level await codegen, logical-assignment minification, JS-API deadlock reference counting, duplicated target-engine handling, MP3 MIME detection) with no API/behavior-breaking changes. pg 8.23.0 and @​hono/node-server 2.1.0 are minor bumps within ranges the repo already declared; @​types/pg is a types-only minor.
• Host-platform coupling — The bumped native/toolchain packages (esbuild, rolldown, vite, tsx) run on the Node platform pinned in the Dockerfile (node:24-bookworm-slim) and by engines.node >= 24. Engine ranges recorded in the lockfile for the new versions (esbuild >=18, rolldown ^20.19.0 || >=22.12.0, @​hono/node-server >=20, readdirp >=20.19.0, ip-address >=12) all include Node 24. The CI Docker Build check installed this exact lockfile and ran the production build on that base image successfully — an empirical compatibility check on the host platform.
• Test-suite check (must_check) — CI Tests succeeded, alongside Lint, Typecheck, Build, Docker Build, and npm audit.

Sources

• esbuild v0.28.2 release notes: https://github.com/evanw/esbuild/releases/tag/v0.28.2 (stable patch release, bug fixes only)
• Repository files read: package.json (engines node >=24; dependency ranges unchanged; postcss/sharp overrides preserved) and Dockerfile (node:24-bookworm-slim base image)
• CI status for the head commit: Lint, Typecheck, Tests, Build, Docker Build, npm audit, review — all success

Standards Compliance

• The change touches only the lockfile; no source, Prisma schema, auth, environment-variable, Docker, or workflow conventions are affected.
• The documented postcss and sharp override pins in package.json are left intact, consistent with the repository's advisory-remediation policy ('DO NOT remove without verifying the originating transitive deps have shipped patched versions').
• The npm audit CI check passes, consistent with the repository's security posture.

Unknowns / Needs Verification

• An official Node.js 24 support/compatibility matrix page could not be fetched within the tool budget, so no matrix URL is cited. This is mitigated by (a) engine ranges in the lockfile for every newly locked version, all of which include Node 24, and (b) the CI Docker Build that ran npm ci and built on the exact node:24-bookworm-slim host image with this lockfile. If a citable matrix entry is required before merge, confirm Node 24 support status first (e.g., https://nodejs.org/en/about/previous-releases).
• The Renovate PR-body warning that some dependencies could not be looked up is standard Renovate boilerplate pointing to the dependency dashboard; it does not indicate lockfile inconsistency, since npm ci and the full build/test pipeline passed in CI.

[its-miso]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a routine Renovate lock-file maintenance change: only package-lock.json is modified, package.json (dependency ranges, engines, overrides) is untouched, and every locked version bump is a patch or minor within an already-declared semver range. All CI gates — Lint, Typecheck, Tests, Build, Docker Build, npm audit — pass on the head commit, including a full production-image build on the exact node:24-bookworm-slim host platform.

Change-by-change findings

• package-lock.json — Refresh bumps about 20 packages: esbuild 0.28.1 → 0.28.2 with all platform binaries in lockstep; rolldown 1.2.2 → 1.2.3 with @​oxc-project/types 0.142.0 → 0.143.0; pg 8.22.0 → 8.23.0 with pg-protocol 1.15.0 → 1.16.0 and @​types/pg 8.20.3 → 8.21.0; hono 4.13.0 → 4.13.1 and @​hono/node-server 2.0.12 → 2.1.0; vite 8.2.0 → 8.2.1; tsx 4.23.11 → 4.23.12; postcss 8.5.25 → 8.5.26 with nanoid 3.3.17 → 3.3.18; plus express-rate-limit, ip-address, readdirp, axe-core, browserslist/caniuse-lite and related data packages. No package.json manifest changes, so no new ranges, engines entries, or overrides are introduced.
• Breaking-change check (must_check) — No bump crosses a major version. esbuild 0.28.2 release notes were fetched and describe only bug fixes (TypeScript import-alias tree-shaking, CSS minification of &, input-overwrite regression, top-level await codegen, logical-assignment minification, JS-API deadlock reference counting, duplicated target-engine handling, MP3 MIME detection) with no API/behavior-breaking changes. pg 8.23.0 and @​hono/node-server 2.1.0 are minor bumps within ranges the repo already declared; @​types/pg is a types-only minor.
• Host-platform coupling — The bumped native/toolchain packages (esbuild, rolldown, vite, tsx) run on the Node platform pinned in the Dockerfile (node:24-bookworm-slim) and by engines.node >= 24. Engine ranges recorded in the lockfile for the new versions (esbuild >=18, rolldown ^20.19.0 || >=22.12.0, @​hono/node-server >=20, readdirp >=20.19.0, ip-address >=12) all include Node 24. The CI Docker Build check installed this exact lockfile and ran the production build on that base image successfully — an empirical compatibility check on the host platform.
• Test-suite check (must_check) — CI Tests succeeded, alongside Lint, Typecheck, Build, Docker Build, and npm audit.

Sources

• esbuild v0.28.2 release notes: https://github.com/evanw/esbuild/releases/tag/v0.28.2 (stable patch release, bug fixes only)
• Repository files read: package.json (engines node >=24; dependency ranges unchanged; postcss/sharp overrides preserved) and Dockerfile (node:24-bookworm-slim base image)
• CI status for the head commit: Lint, Typecheck, Tests, Build, Docker Build, npm audit, review — all success

Standards Compliance

• The change touches only the lockfile; no source, Prisma schema, auth, environment-variable, Docker, or workflow conventions are affected.
• The documented postcss and sharp override pins in package.json are left intact, consistent with the repository's advisory-remediation policy ('DO NOT remove without verifying the originating transitive deps have shipped patched versions').
• The npm audit CI check passes, consistent with the repository's security posture.

Unknowns / Needs Verification

• An official Node.js 24 support/compatibility matrix page could not be fetched within the tool budget, so no matrix URL is cited. This is mitigated by (a) engine ranges in the lockfile for every newly locked version, all of which include Node 24, and (b) the CI Docker Build that ran npm ci and built on the exact node:24-bookworm-slim host image with this lockfile. If a citable matrix entry is required before merge, confirm Node 24 support status first (e.g., https://nodejs.org/en/about/previous-releases).
• The Renovate PR-body warning that some dependencies could not be looked up is standard Renovate boilerplate pointing to the dependency dashboard; it does not indicate lockfile inconsistency, since npm ci and the full build/test pipeline passed in CI.

[its-miso]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a routine Renovate lock-file maintenance change: only package-lock.json is modified, package.json (dependency ranges, engines, overrides) is untouched, and every locked version bump is a patch or minor within an already-declared semver range. All CI gates — Lint, Typecheck, Tests, Build, Docker Build, npm audit — pass on the head commit, including a full production-image build on the exact node:24-bookworm-slim host platform.

Change-by-change findings

• package-lock.json — Refresh bumps about 20 packages: esbuild 0.28.1 → 0.28.2 with all platform binaries in lockstep; rolldown 1.2.2 → 1.2.3 with @​oxc-project/types 0.142.0 → 0.143.0; pg 8.22.0 → 8.23.0 with pg-protocol 1.15.0 → 1.16.0 and @​types/pg 8.20.3 → 8.21.0; hono 4.13.0 → 4.13.1 and @​hono/node-server 2.0.12 → 2.1.0; vite 8.2.0 → 8.2.1; tsx 4.23.11 → 4.23.12; postcss 8.5.25 → 8.5.26 with nanoid 3.3.17 → 3.3.18; plus express-rate-limit, ip-address, readdirp, axe-core, browserslist/caniuse-lite and related data packages. No package.json manifest changes, so no new ranges, engines entries, or overrides are introduced.
• Breaking-change check (must_check) — No bump crosses a major version. esbuild 0.28.2 release notes were fetched and describe only bug fixes (TypeScript import-alias tree-shaking, CSS minification of &, input-overwrite regression, top-level await codegen, logical-assignment minification, JS-API deadlock reference counting, duplicated target-engine handling, MP3 MIME detection) with no API/behavior-breaking changes. pg 8.23.0 and @​hono/node-server 2.1.0 are minor bumps within ranges the repo already declared; @​types/pg is a types-only minor.
• Host-platform coupling — The bumped native/toolchain packages (esbuild, rolldown, vite, tsx) run on the Node platform pinned in the Dockerfile (node:24-bookworm-slim) and by engines.node >= 24. Engine ranges recorded in the lockfile for the new versions (esbuild >=18, rolldown ^20.19.0 || >=22.12.0, @​hono/node-server >=20, readdirp >=20.19.0, ip-address >=12) all include Node 24. The CI Docker Build check installed this exact lockfile and ran the production build on that base image successfully — an empirical compatibility check on the host platform.
• Test-suite check (must_check) — CI Tests succeeded, alongside Lint, Typecheck, Build, Docker Build, and npm audit.

Sources

• esbuild v0.28.2 release notes: https://github.com/evanw/esbuild/releases/tag/v0.28.2 (stable patch release, bug fixes only)
• Repository files read: package.json (engines node >=24; dependency ranges unchanged; postcss/sharp overrides preserved) and Dockerfile (node:24-bookworm-slim base image)
• CI status for the head commit: Lint, Typecheck, Tests, Build, Docker Build, npm audit, review — all success

Standards Compliance

• The change touches only the lockfile; no source, Prisma schema, auth, environment-variable, Docker, or workflow conventions are affected.
• The documented postcss and sharp override pins in package.json are left intact, consistent with the repository's advisory-remediation policy ('DO NOT remove without verifying the originating transitive deps have shipped patched versions').
• The npm audit CI check passes, consistent with the repository's security posture.

Unknowns / Needs Verification

• An official Node.js 24 support/compatibility matrix page could not be fetched within the tool budget, so no matrix URL is cited. This is mitigated by (a) engine ranges in the lockfile for every newly locked version, all of which include Node 24, and (b) the CI Docker Build that ran npm ci and built on the exact node:24-bookworm-slim host image with this lockfile. If a citable matrix entry is required before merge, confirm Node 24 support status first (e.g., https://nodejs.org/en/about/previous-releases).
• The Renovate PR-body warning that some dependencies could not be looked up is standard Renovate boilerplate pointing to the dependency dashboard; it does not indicate lockfile inconsistency, since npm ci and the full build/test pipeline passed in CI.

[its-miso]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a routine Renovate lock-file maintenance change: only package-lock.json is modified, package.json (dependency ranges, engines, overrides) is untouched, and every locked version bump is a patch or minor within an already-declared semver range. All CI gates — Lint, Typecheck, Tests, Build, Docker Build, npm audit — pass on the head commit, including a full production-image build on the exact node:24-bookworm-slim host platform.

Change-by-change findings

• package-lock.json — Refresh bumps about 20 packages: esbuild 0.28.1 → 0.28.2 with all platform binaries in lockstep; rolldown 1.2.2 → 1.2.3 with @​oxc-project/types 0.142.0 → 0.143.0; pg 8.22.0 → 8.23.0 with pg-protocol 1.15.0 → 1.16.0 and @​types/pg 8.20.3 → 8.21.0; hono 4.13.0 → 4.13.1 and @​hono/node-server 2.0.12 → 2.1.0; vite 8.2.0 → 8.2.1; tsx 4.23.11 → 4.23.12; postcss 8.5.25 → 8.5.26 with nanoid 3.3.17 → 3.3.18; plus express-rate-limit, ip-address, readdirp, axe-core, browserslist/caniuse-lite and related data packages. No package.json manifest changes, so no new ranges, engines entries, or overrides are introduced.
• Breaking-change check (must_check) — No bump crosses a major version. esbuild 0.28.2 release notes were fetched and describe only bug fixes (TypeScript import-alias tree-shaking, CSS minification of &, input-overwrite regression, top-level await codegen, logical-assignment minification, JS-API deadlock reference counting, duplicated target-engine handling, MP3 MIME detection) with no API/behavior-breaking changes. pg 8.23.0 and @​hono/node-server 2.1.0 are minor bumps within ranges the repo already declared; @​types/pg is a types-only minor.
• Host-platform coupling — The bumped native/toolchain packages (esbuild, rolldown, vite, tsx) run on the Node platform pinned in the Dockerfile (node:24-bookworm-slim) and by engines.node >= 24. Engine ranges recorded in the lockfile for the new versions (esbuild >=18, rolldown ^20.19.0 || >=22.12.0, @​hono/node-server >=20, readdirp >=20.19.0, ip-address >=12) all include Node 24. The CI Docker Build check installed this exact lockfile and ran the production build on that base image successfully — an empirical compatibility check on the host platform.
• Test-suite check (must_check) — CI Tests succeeded, alongside Lint, Typecheck, Build, Docker Build, and npm audit.

Sources

• esbuild v0.28.2 release notes: https://github.com/evanw/esbuild/releases/tag/v0.28.2 (stable patch release, bug fixes only)
• Repository files read: package.json (engines node >=24; dependency ranges unchanged; postcss/sharp overrides preserved) and Dockerfile (node:24-bookworm-slim base image)
• CI status for the head commit: Lint, Typecheck, Tests, Build, Docker Build, npm audit, review — all success

Standards Compliance

• The change touches only the lockfile; no source, Prisma schema, auth, environment-variable, Docker, or workflow conventions are affected.
• The documented postcss and sharp override pins in package.json are left intact, consistent with the repository's advisory-remediation policy ('DO NOT remove without verifying the originating transitive deps have shipped patched versions').
• The npm audit CI check passes, consistent with the repository's security posture.

Unknowns / Needs Verification

• An official Node.js 24 support/compatibility matrix page could not be fetched within the tool budget, so no matrix URL is cited. This is mitigated by (a) engine ranges in the lockfile for every newly locked version, all of which include Node 24, and (b) the CI Docker Build that ran npm ci and built on the exact node:24-bookworm-slim host image with this lockfile. If a citable matrix entry is required before merge, confirm Node 24 support status first (e.g., https://nodejs.org/en/about/previous-releases).
• The Renovate PR-body warning that some dependencies could not be looked up is standard Renovate boilerplate pointing to the dependency dashboard; it does not indicate lockfile inconsistency, since npm ci and the full build/test pipeline passed in CI.

[its-miso]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a routine Renovate lock-file maintenance change: only package-lock.json is modified, package.json (dependency ranges, engines, overrides) is untouched, and every locked version bump is a patch or minor within an already-declared semver range. All CI gates — Lint, Typecheck, Tests, Build, Docker Build, npm audit — pass on the head commit, including a full production-image build on the exact node:24-bookworm-slim host platform.

Change-by-change findings

• package-lock.json — Refresh bumps about 20 packages: esbuild 0.28.1 → 0.28.2 with all platform binaries in lockstep; rolldown 1.2.2 → 1.2.3 with @​oxc-project/types 0.142.0 → 0.143.0; pg 8.22.0 → 8.23.0 with pg-protocol 1.15.0 → 1.16.0 and @​types/pg 8.20.3 → 8.21.0; hono 4.13.0 → 4.13.1 and @​hono/node-server 2.0.12 → 2.1.0; vite 8.2.0 → 8.2.1; tsx 4.23.11 → 4.23.12; postcss 8.5.25 → 8.5.26 with nanoid 3.3.17 → 3.3.18; plus express-rate-limit, ip-address, readdirp, axe-core, browserslist/caniuse-lite and related data packages. No package.json manifest changes, so no new ranges, engines entries, or overrides are introduced.
• Breaking-change check (must_check) — No bump crosses a major version. esbuild 0.28.2 release notes were fetched and describe only bug fixes (TypeScript import-alias tree-shaking, CSS minification of &, input-overwrite regression, top-level await codegen, logical-assignment minification, JS-API deadlock reference counting, duplicated target-engine handling, MP3 MIME detection) with no API/behavior-breaking changes. pg 8.23.0 and @​hono/node-server 2.1.0 are minor bumps within ranges the repo already declared; @​types/pg is a types-only minor.
• Host-platform coupling — The bumped native/toolchain packages (esbuild, rolldown, vite, tsx) run on the Node platform pinned in the Dockerfile (node:24-bookworm-slim) and by engines.node >= 24. Engine ranges recorded in the lockfile for the new versions (esbuild >=18, rolldown ^20.19.0 || >=22.12.0, @​hono/node-server >=20, readdirp >=20.19.0, ip-address >=12) all include Node 24. The CI Docker Build check installed this exact lockfile and ran the production build on that base image successfully — an empirical compatibility check on the host platform.
• Test-suite check (must_check) — CI Tests succeeded, alongside Lint, Typecheck, Build, Docker Build, and npm audit.

Sources

• esbuild v0.28.2 release notes: https://github.com/evanw/esbuild/releases/tag/v0.28.2 (stable patch release, bug fixes only)
• Repository files read: package.json (engines node >=24; dependency ranges unchanged; postcss/sharp overrides preserved) and Dockerfile (node:24-bookworm-slim base image)
• CI status for the head commit: Lint, Typecheck, Tests, Build, Docker Build, npm audit, review — all success

Standards Compliance

• The change touches only the lockfile; no source, Prisma schema, auth, environment-variable, Docker, or workflow conventions are affected.
• The documented postcss and sharp override pins in package.json are left intact, consistent with the repository's advisory-remediation policy ('DO NOT remove without verifying the originating transitive deps have shipped patched versions').
• The npm audit CI check passes, consistent with the repository's security posture.

Unknowns / Needs Verification

• An official Node.js 24 support/compatibility matrix page could not be fetched within the tool budget, so no matrix URL is cited. This is mitigated by (a) engine ranges in the lockfile for every newly locked version, all of which include Node 24, and (b) the CI Docker Build that ran npm ci and built on the exact node:24-bookworm-slim host image with this lockfile. If a citable matrix entry is required before merge, confirm Node 24 support status first (e.g., https://nodejs.org/en/about/previous-releases).
• The Renovate PR-body warning that some dependencies could not be looked up is standard Renovate boilerplate pointing to the dependency dashboard; it does not indicate lockfile inconsistency, since npm ci and the full build/test pipeline passed in CI.