chore(deps): nightly patch/minor dependency bump (53 packages)

[pat-lewczuk]

Automated nightly dependency bump. Patch/minor only — no major bumps.

Verification

All three run against the final tree:

check	result
yarn test	554 passed / 554, 48 suites
yarn typecheck	clean
yarn build	succeeds (exit 0)

The one thing worth reading

Bumping @mikro-orm/* 7.1.5 → 7.2.0 initially broke the build with 85 TS2322 errors.

The cause was not the new version. @open-mercato/{shared,core,cli} depend on @mikro-orm/core: ^7.1.5, which 7.2.0 satisfies — but Yarn does not re-dedupe on install, so it kept the old 7.1.13 resolution nested under each of those three packages while our direct dependency moved to 7.2.0. Two copies of @mikro-orm/core in the tree means two structurally distinct FilterQuery<T> types, and every command that passes a query across the boundary stopped type-checking:

Type 'ObjectQuery<Team>' is not assignable to type 'FilterQuery<Team>'
  ... node_modules/@mikro-orm/core/typings
  ... node_modules/@open-mercato/shared/node_modules/@mikro-orm/core/typings

yarn dedupe collapses it to a single 7.2.0 and all 85 errors go away. That dedupe is part of commit 1 and accounts for most of the yarn.lock churn.

Commits

Two commits, deliberately split so the second can be dropped on its own.

1. c516653 — 48 in-range bumps. Every caret-ranged dependency to the newest release inside its declared range.

All 48

@ai-sdk/anthropic 4.0.40→4.0.53 · @ai-sdk/openai 4.0.45→4.0.66 · @mikro-orm/core,decorators,migrations,postgresql 7.1.5→7.2.0 · @radix-ui/react-checkbox 1.3.3→1.3.11 · @radix-ui/react-dialog 1.0.5→1.1.23 · @radix-ui/react-label 2.1.8→2.1.15 · @radix-ui/react-slot 1.2.4→1.3.3 · @react-email/components 1.0.1→1.0.12 · @stripe/react-stripe-js 3.9.0→3.11.0 · @stripe/stripe-js 7.8.0→7.10.0 · @tailwindcss/typography 0.5.19→0.5.20 · @tanstack/react-query 5.90.12→5.102.8 · @tanstack/react-table 8.20.5→8.21.3 · @uiw/react-markdown-preview 5.1.5→5.2.1 · @uiw/react-md-editor 4.0.11→4.1.2 · ai 7.0.4→7.0.100 · awilix 12.0.5→12.1.1 · dotenv 17.2.3→17.4.2 · newrelic 13.7.0→13.20.0 · react-big-calendar 1.19.4→1.20.0 · react-email 5.0.6→5.2.11 · react-is 19.2.0→19.3.0 · resend 6.5.2→6.28.0 · semver 7.7.3→7.8.5 · tailwind-merge 3.4.0→3.7.0 · zod 4.4.3→4.6.5 · @playwright/test 1.50.0→1.63.0 · @tailwindcss/postcss 4.1.17→4.3.3 · @testing-library/dom 10.4.0→10.4.2 · @testing-library/jest-dom 6.9.1→6.10.0 · @testing-library/react 16.2.0→16.3.3 · @types/node 24.10.1→24.13.4 · @types/react 19.2.7→19.3.0 · @types/react-dom 19.2.3→19.3.0 · @types/react-is 19.0.0→19.3.0 · @types/sanitize-html 2.16.0→2.16.1 · @types/semver 7.7.0→7.8.0 · eslint 9.0.0→9.39.5 · jest 30.2.0→30.5.1 · tailwindcss 4.1.17→4.3.3 · ts-jest 29.4.6→29.4.12 · tsx 4.7.0→4.23.13 · better-sqlite3 12.5.0→12.11.1 · bullmq 5.34.8→5.81.5 · ioredis 5.8.2→5.11.1

2. 6800b0c — 5 exact-pinned bumps. These have no caret, so commit 1 could not move them:

package	from	to
next	16.1.5	16.3.5
eslint-config-next	16.0.7	16.3.5
react	19.2.1	19.3.0
react-dom	19.2.1	19.3.0
pg	8.20.0	8.23.0

React stays within the ^19.0.0 peer range @open-mercato/core declares. This is the riskier half — if you would rather not take the Next/React minor right now, drop this commit and commit 1 still stands on its own.

Deliberately not bumped

• @open-mercato/* (13 packages) 0.6.7 → 0.7.0. @open-mercato/core hard-pins all 12 siblings at exactly 0.6.7, so the family only moves as a single unit. On a 0.x line a minor is breaking by convention, and AGENTS.md routes framework upgrades through a dedicated upgrade skill with migration/codemod steps. That is not a nightly job — it needs its own PR.
• lucide-react 0.556.0 → 0.577.0 and language-subtag-registry 0.3.23 → 0.4.2. Both 0.x minors, i.e. breaking by convention and outside the caret range. AGENTS.md specifically records lucide-react minor bumps removing brand icons and breaking this repo during the 0.5.0 upgrade.
• All major bumps. @stripe/react-stripe-js 3→6, @stripe/stripe-js 7→9, @tanstack/react-table 8→9, awilix 12→13, react-email 5→6, newrelic 13→14, @testing-library/jest-dom 6→7, @types/node 24→26, eslint 9→10, typescript 5→7, better-sqlite3 12→13, bullmq 5→6, ioredis 5→6.

Notes

• The repo is Yarn 4.12.0, so npm outdated is not the right probe against a Yarn lockfile. The outdated set was resolved straight from the npm registry per dependency and filtered to same-major (and, for 0.x, same-minor) candidates.
• No source files changed — only package.json and yarn.lock.

🤖 Generated with Claude Code