chore(deps): upgrade TypeScript 7, nanoid 6, jsdom 30, @types/node 26

[mikevalstar]

Rebased onto main. The bulk of the original sweep — the minor/patch batch, assistant-ui 0.15, the AI SDK bumps, and the node-ical 0.27 VEvent typing fix — landed via #94, so this branch is now just the four remaining majors, in one commit.

Verified with pnpm type-check, pnpm test (59 tests), pnpm check, and pnpm build.

Upgraded

• TypeScript 7.0.2 — the native compiler port. Type-checks clean with no source changes.
• nanoid 6 — drop-in; all four call sites use the plain nanoid() named import.
• jsdom 30 — drop-in.
• @types/node 26.1.2 — resolves to 26.2.0.

Held back — blocked upstream

better-sqlite3 13 — @prisma/adapter-better-sqlite3 hard-deps better-sqlite3@^12.6.0. Bumping ours installs a second copy, so Prisma's connection and the sqlite-vec embeddings sidecar (src/lib/embeddings/db.ts) would each load a different native SQLite build in the same process. This was tested before backing it out: sqlite-vec loads fine under 13.0.2 and the embeddings tests pass — it works, it's just not worth a duplicate native module. Revisit when Prisma bumps its range.

Note on srvx

The previous version of this PR held srvx at 0.11.22 because @tanstack/start-plugin-core and h3 both pin ^0.11.x. Dependabot's #94 bumped it to ^0.12.5 anyway, so main now carries both copies. In practice the two only meet at server.ts:2, where srvx/node's toNodeHandler hands a standard Request to the TanStack-built handler — a Web-standard boundary, and a production server boot serves /login fine. Flagging it as a known duplicate rather than a blocker.

Still needs a human pass

assistant-ui 0.15 is not runtime-verified — it came in via #94 rather than this branch, but nobody has clicked through /chat in a browser. A 0.x minor is a breaking release for this library. Worth exercising streaming, message editing, branch navigation, and sub-agent rendering.

Incidental observation

jsdom is in devDependencies but referenced nowhere outside package.json, and no vitest config selects that environment. Upgraded rather than removed, since that's outside this PR's scope — but it looks like a pnpm knip candidate.

🤖 Generated with Claude Code

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• .github/workflows/ci.yml - GitHub Actions version bumps (checkout v7, pnpm-setup v6.0.10, setup-node v7.0.0)
• package.json - Additional patch/minor dependency updates (assistant-ui 0.15.8, ai 7.0.56, better-auth 1.6.26, srvx 0.12.5, etc.)
• pnpm-lock.yaml - Lock file updates

Incremental Review Notes

Changes since commit b75346af are routine maintenance:

1. CI workflow - Standard GitHub Actions version bumps to latest major versions
2. Dependencies - Patch/minor version updates across the board:
   • @assistant-ui/react 0.15.1 → 0.15.8
   • ai 7.0.47 → 7.0.56
   • better-auth 1.6.25 → 1.6.26
   • srvx 0.11.22 → 0.12.5 (as noted in PR description, this creates a duplicate but they're compatible at the Web-standard boundary)
   • Various devDependencies (biome, rsbuild, storybook, vite, etc.)

All changes align with the PR description - verified with pnpm type-check, pnpm test, pnpm check, and pnpm build passing.

Previous Review Summary (commit b75346a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit b75346a)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• package.json - Dependency upgrades (TypeScript 7.0.2, assistant-ui 0.15.1, node-ical 0.27, and various other deps)
• pnpm-lock.yaml - Lock file updates
• src/lib/calendar/ical-parser.ts - Added VEvent type import to accommodate node-ical 0.27 API changes

Review Notes

The only source code change is correct and minimal:

• Before: import ical, { type ParameterValue } from "node-ical";
• After: import ical, { type ParameterValue, type VEvent } from "node-ical";

This properly accommodates the node-ical 0.27 breaking change where the ical type namespace was replaced with named exports. The VEvent type is correctly used in:

• Line 17: Function parameter type annotation
• Line 143: Type assertion (component as VEvent)

All changes align with the PR description - routine dependency upgrades with verified type-check, tests, and build passing.

---

_{Reviewed by kimi-k2.5 · Input: 69.4K · Output: 1.8K · Cached: 270.8K}