chore(deps): bump the minor-and-patch group with 12 updates (supersedes #479)

[huyplb]

The same 12 minor/patch bumps as Dependabot's #479, on current main.

#479 conflicted with main once #482–#485 changed the lockfile. Its build gate also never ran after the branch was updated. This carries Dependabot's package.json changes (commit f1f5432) verbatim, with package-lock.json regenerated by npm install --package-lock-only on top of main.

Package	From	To
eslint-plugin-security	4.0.1	4.2.0
turbo	2.11.4	2.11.6
typescript-eslint	8.70.1	8.71.0
vitest	5.0.2	5.0.3
mysql2	3.24.4	3.24.5
pg	8.23.0	8.23.1
chalk	6.0.0	6.0.1
lucide-react	1.48.0	1.50.0
@types/node	26.6.3	26.6.4
vite	8.3.1	8.3.2
@aws-sdk/client-secrets-manager	3.1141.0	3.1145.0
@google-cloud/secret-manager	7.1.0	7.1.1

Lockfile changes beyond the 12

• Their transitive updates: rolldown bindings 1.2.9→1.2.12, the typescript-eslint packages, and @vitest/*.
• 18 entries removed by deduplication: apps/web's nested vite, lightningcss and postcss now resolve to the root copies. teeny-request, stubs and stream-events drop out with secret-manager 7.1.1.
• No packages added.

Checked locally

• npm ci, typecheck, eslint and the production build all pass.
• First visit is within the 170 KB gzip budget.
• npm audit --audit-level=high --omit=dev passes.
• npx vitest run: 5842 passed, 1 failed. The failure is migration-file.test.ts › handles hostile input in linear time, a 1000 ms wall-clock budget. Run alone, it takes the same ~480 ms on main and on this branch, three runs each. It only goes over in the full parallel run on a sandbox that is also running 11 database containers. CI decides.

🤖 Generated with Claude Code

https://claude.ai/code/session_016PyNv48vpYUw2HhpjYFNUi

---

Generated by Claude Code

---

Note

Low Risk
Patch/minor dependency-only changes; driver bumps are small but touch runtime DB connectivity paths used widely in the monorepo.

Overview
Bumps 12 direct dependencies across the workspace with no application code changes—only package.json manifests and a regenerated package-lock.json.

Tooling & tests (root): eslint-plugin-security 4.2.0, turbo 2.11.6, typescript-eslint 8.71.0, vitest 5.0.3 (also in apps/e2e).

Web & CLI: vite 8.3.2, lucide-react 1.50.0, @types/node 26.6.4, optional cloud secret clients (@aws-sdk/client-secrets-manager, @google-cloud/secret-manager), and chalk 6.0.1 in the CLI.

Database drivers (web, @foxschema/db peers, workflow-engine): mysql2 3.24.5 and pg 8.23.1.

The lockfile also picks up transitive updates (e.g. rolldown 1.2.12) and deduplicates nested apps/web copies of vite/lightningcss/postcss onto the hoisted tree; some Google client helper packages drop out with the secret-manager bump.

^{Reviewed by Cursor Bugbot for commit f2e9c9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: c2020829-62b9-4665-9c3c-ded8d520d4c7)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: df9bb830-8078-435a-ab1d-22c4825b93fd)