chore(deps): clear all 11 Dependabot alerts + minor-and-patch group

[timothybrown]

Supersedes #60, #61 and #62, all of which CI rejected.

Why these three PRs could not be merged

#60 and #62 failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Dependabot regenerates pnpm-lock.yaml without the pnpm.overrides block, so pnpm install --frozen-lockfile refuses the lockfile. This is the known failure mode — the fix is to re-resolve locally with overrides intact and supersede, never to merge as-is.

#61 bumped anyio in /tools/fixtures only. The same advisory applies to four lockfiles. Its e2e failure was unrelated to the bump: the simulator backfill hit httpx.ReadTimeout fetching the Open-Meteo archive API (see note below).

Security alerts cleared (11 → 0)

Package	Severity	Fix
anyio	critical + medium	4.13.0 → 4.15.1 in backend, tests/e2e, tools/fixtures, tools/simulator
js-yaml	high	→ 4.3.2 (override floor raised)
sharp	high	→ 0.35.4 (override floor raised)
baseline-browser-mapping	medium	→ 2.11.21 (new override floor)

Two details worth flagging:

• uv lock --upgrade-package anyio under-shot to 4.14.2 in backend while the other three went to 4.15.1. Pinned that resolve to >=4.15 so all four lockfiles agree. No manifest constraints were added — backend/pyproject.toml is untouched.
• browserslist was pulling a vulnerable baseline-browser-mapping@2.10.34 alongside a patched 2.11.21, so the existing browserslist override was not enough on its own and the package needed a floor of its own.

All overrides use caret floors, not exact pins.

minor-and-patch group (#60)

All 11 packages land at or above #60's targets: next/eslint-config-next 16.3.4, react/react-dom/@types/react/@types/react-dom 19.3.0, @types/node 26.6.2, tailwindcss + @tailwindcss/postcss 4.3.3, happy-dom 20.14.5, orval 8.34.0.

Note that next 16.3.4 re-enables AVIF image optimization and requires sharp 0.35.4 — so #60 and #62 were coupled and had to ship together anyway.

Verification

Ran the full CI gate for both stacks locally:

• pnpm install --frozen-lockfile — succeeds (the exact step that failed on chore(deps): bump the minor-and-patch group across 1 directory with 11 updates #60/chore(deps): bump sharp from 0.35.3 to 0.35.4 in /frontend #62)
• frontend: generate, tsc --noEmit, lint, build all clean; 601 tests pass (57 files)
• backend: ruff check app/ and mypy app/ clean; 317 tests pass
• pnpm generate under orval 8.34 produced byte-identical output

Out of scope

The e2e job seeds by backfilling from the live Open-Meteo archive API, which is what flaked on #61. That is a real source of CI flakiness independent of any dependency bump, but fixing it is a separate change and I left it alone.

🤖 Generated with Claude Code