[seenu-k]

Summary

The server dependency update fails because jose's payload inference no longer matches the Google Pub/Sub claims annotation. The TypeScript 7 and standalone Dartdoc holds also no longer describe the validated platform. Use jose's verified JWTPayload type with the existing runtime checks, move server/scaffold compilation to stable TypeScript 7, and remove the Dartdoc workaround after testing the SDK command on all three Flutter packages.

This consolidates and extends Dependabot #148, #152, #153 and #154. Their branches and PRs remain open for coordination; this branch includes their updates plus newer reviewed stable fixes.

Changes

• Update tsdown to 0.23.4 and server/scaffold TypeScript to 7.0.2. Remove the server major-version ignore. Keep the independent web compiler at 6.0.3 because stable TypeDoc/plugin peers still exclude TS7.
• Move framework and scaffold FVM pins to Flutter 3.47.9 / Dart 3.13.7, including the certificate-store security hotfix and workspace native-assets test fix.
• Update jose to 6.2.15 and require Hono 4.13.16 so published consumers receive its router/security fixes. Google private claims remain unknown until the existing account/verification checks validate them.
• Align Wrangler 4.156.1, workers-types 5.20261101.1 and Cloudflare Vitest plugin 1.4.12; regenerate Worker bindings. Existing explicit compatibility dates remain the runtime contract.
• Update Biome 2.6.4, Sass 1.107.1, the reviewed Java/App-token actions and compatible transitive ranges. Use the exact v3.3.0 app-token tag and keep narrowly scoped permissions.
• Migrate Biome configurations with the CLI and make the generated project's configuration explicitly standalone. Remove obsolete version-specific release-age exceptions using pnpm's config CLI.
• Remove root Dartdoc 9.0.8 through Pub and use SDK dart doc --dry-run in the gate. No incompatible dependency overrides are added.
• Record the semantic release-note review, actual hold-removal probes, remaining owner constraints and fresh audit results in the dependency review and blocker register.

Validation

GitHub Platform checks passed for commit d860a66f, including the Linux Android/web scaffold builds and SDK documentation checks.

The follow-up action-reference change was verified against the official tag: v3.3.0 resolves to the previously selected commit. All seven workflow YAML files parse, and comparing their parsed configuration confirms only the seven action references changed. The Dart release coordinator check and git diff --check also pass.

The complete local ./tool/check.sh passed with the selected toolchains: 733 server-workspace tests; client 191 plus 21 Chrome tests; codegen 16; Flutter framework/example 175/37; shell/Firebase 120/44; builds, analysis, generated-artifact and migration drift checks, package dry runs, docs typecheck/build and SDK documentation validation.

Fresh CLI scaffold validation passed Worker typecheck/9 tests, Flutter analysis/10 tests, Android release APK and web release with service-worker precaching. Frozen installs also pass after pruning the obsolete install exceptions.

Negative probes reproduced the retained holds: analyzer-14 generator upgrades conflict with the SDK test pins; build_runner's build-5 requirement conflicts with even the latest Riverpod generator; built-in Kotlin fails in the published review plugin; the new DSL separately fails in Flutter's Gradle plugin.

The first full run caught the template migration's accidental root: false. Corrected the standalone configuration and reran the entire gate successfully. No checks were disabled.

Retained constraints and release

Compatible refreshes take Joi 17.13.9's fix. Remaining tooling advisories: root 3 (2 moderate, 1 low), server 1 moderate, web 16 (2 critical, 7 high, 5 moderate, 2 low). Their stable owners still constrain affected versions; details and available migration alternatives are documented. Drizzle 1.0 RC would require a coordinated ORM/Kit and migration-layout change, and Docusaurus 4 remains canary.

The Changeset covers the server and scaffolder. Package versions stay managed by the release workflows; no hand-written Dart package release is required solely for the SDK/tooling changes. No hosted infrastructure or publication is changed by this PR.