[RustedAperture]

Rolls up the open Dependabot PRs and fixes the open security alerts.

Bumps (supersedes #133, #148, #149, #150, #153, #154, #155)

• react / react-dom 19.3.1, @types/react / @types/react-dom 19.3.0
• happy-dom 21.0.4, @base-ui/react 1.9.0, recharts 3.10.1
• @tailwindcss/postcss 4.3.3, pino 10.4.0, docker/login-action v4.7.0

Other in-range updates (not opened by Dependabot)

• Server: discord.js 14.28.1, express 5.3.0, helmet 8.3.0, eslint 10.14.0, typescript-eslint 8.72.1, prettier 3.9.10, vite 8.3.5, supertest 7.3.1, pino-pretty 13.2.0, globals, type packages
• Web: next 16.4.5, radix-ui 1.8.1, react-hook-form 7.91.0, @hookform/resolvers 5.9.2, swr 2.5.1, lucide-react 1.68.0, shadcn 4.23.0, framer-motion 12.43.0, tailwind-merge 3.7.0, react-resizable-panels 4.18.1, input-otp 1.5.0, react-day-picker 10.0.2, testing-library, eslint-config-next 16.4.5
• Major versions left for later: typescript 7, vitest 5, framer-motion 14, @hookform/resolvers 7, jest-dom 7, dotenv 18

Security overrides

• body-parser ^2.4.0 (high)
• happy-dom ^21.0.4 (high, also vitest's peer copy)
• postcss-selector-parser ^6.1.5 for @tailwindcss/typography (moderate)
• minimatch 10.x -> ^11.0.4 (moderate, via eslint)

Other

• Deduped react and @types/react in the lockfile (two copies broke tests and the build)
• Test setup hides Element.animate: happy-dom 21 added Web Animations, and framer-motion left cancel rejections unhandled

Not fixed

• deepmerge (low): no patched version exists; it comes from shadcn

Checks: npm ci, lint, lint:web, test, test:web, build, format:check all pass locally.

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable new issues were found.

Summary

Updates server and web dependencies, adds security overrides, and bumps the Docker login action.

• The bot and server use newer Discord, Express, security, and logging packages.
• The web app and its tools use newer React, Next.js, and UI packages.
• The dependency tree pins four transitive packages to newer versions.
• Web tests use JavaScript animations instead of happy-dom's Web Animations API.
• Both image-publishing jobs use docker/login-action v4.7.0.

_{Reviews (2) · Last reviewed commit: "chore(deps): update remaining in-range d..." · Reviewed by Greptile}