chore(deps): lock file maintenance

[squiggler-app]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • On day 1 of the month, every 12 months (* * 1 */12 *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

---

Note

Low Risk
Lockfile-only maintenance with patch dependency updates and pnpm dedupe settings; no application source changes, though CI should confirm installs and tests still pass.

Overview
Refreshes pnpm-lock.yaml via Renovate lock-file maintenance and aligns the lockfile with newer pnpm resolution settings from pnpm-workspace.yaml.

pnpm-workspace.yaml now enables lockfile.includeResolutionSettings: true, so dedupe/link settings are persisted in the lockfile. The lockfile settings block gains autoDedupe, dedupeInjectedDeps, dedupePeerDependents, and linkWorkspacePackages: false, which drives a broad re-resolution of transitive deps (many patch/minor bumps across CodeMirror, React Aria, mdast, Vitest/MSW, browserslist data, etc.).

Notable graph cleanup: graphql is no longer installed as an optional peer of msw in the example app’s Vitest chain, so MSW/vitest lockfile keys no longer include a graphql@… variant.

^{Reviewed by Cursor Bugbot for commit da00f2f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
async-react	Skipped		Oct 12, 2026 7:46pm UTC
react-rx	Skipped		Oct 12, 2026 7:46pm UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: da00f2f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

This PR is too large for Bugbot to review. It changes 1,638 lines and 207,010 characters. Split the change into smaller pull requests to get a review.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f1f8edf. Configure here.}

[stipsan]

@copilot add any dep to pnpm minimumReleaseAgeExcemptions that you need in order for the install to succeed, use pnpm dedupe instead of pnpm install, then commit the pnpm-lock.yaml and pnpm-workspace.yaml

[stipsan]

@copilot add any dep to pnpm minimumReleaseAgeExcemptions that you need in order for the install to succeed, use pnpm dedupe instead of pnpm install, then commit the pnpm-lock.yaml and pnpm-workspace.yaml

[Copilot]

@copilot add any dep to pnpm minimumReleaseAgeExcemptions that you need in order for the install to succeed, use pnpm dedupe instead of pnpm install, then commit the pnpm-lock.yaml and `pnpm-wor...

pnpm dedupe succeeded and made no further changes. The lockfile/workspace updates are already committed in 787c6fa; no release-age exemption is needed.