chore(deps): land grouped Dependabot updates and unblock CI

.github/dependabot.yml

@@ -6,6 +6,10 @@ version: 2
 # Group runtime + dashboard + SDK by ecosystem to avoid a flood of
 # individual PRs. Ignore major version bumps by default — those need
 # human review.
+#
+# Labels must already exist on the repo. Dependabot comments on every
+# PR if a configured label is missing, so these map to the existing
+# type:* / area:* set rather than inventing `dependencies` / `npm`.
 
 updates:
   # ─── Go: the runtime + CLI ──────────────────────────────────────────────
@@ -26,8 +30,8 @@ updates:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
     labels:
-      - dependencies
-      - go
+      - type:chore
+      - area:runtime
 
   # ─── npm: pnpm workspace (dashboard, customer-app, sdk-ts) ─────────────
   # Update from the repo root. Per-package directories fail with
@@ -50,8 +54,8 @@ updates:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
     labels:
-      - dependencies
-      - npm
+      - type:chore
+      - area:dashboard
 
   # ─── npm: docs site ─────────────────────────────────────────────────────
   - package-ecosystem: npm
@@ -81,9 +85,8 @@ updates:
       - dependency-name: "@types/react"
       - dependency-name: "@types/react-dom"
     labels:
-      - dependencies
-      - npm
-      - docs-site
+      - type:chore
+      - area:docs
 
   # ─── pip: Python SDK ────────────────────────────────────────────────────
   - package-ecosystem: pip
@@ -103,9 +106,8 @@ updates:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
     labels:
-      - dependencies
-      - pip
-      - sdk-py
+      - type:chore
+      - area:sdk-py
 
   # ─── docker: base images ───────────────────────────────────────────────
   - package-ecosystem: docker
@@ -117,8 +119,8 @@ updates:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
     labels:
-      - dependencies
-      - docker
+      - type:chore
+      - area:deploy
 
   - package-ecosystem: docker
     directory: /apps/dashboard
@@ -129,8 +131,8 @@ updates:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
     labels:
-      - dependencies
-      - docker
+      - type:chore
+      - area:deploy
 
   - package-ecosystem: docker
     directory: /apps/customer-app
@@ -141,8 +143,8 @@ updates:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
     labels:
-      - dependencies
-      - docker
+      - type:chore
+      - area:deploy
 
   # ─── github-actions: workflow files ────────────────────────────────────
   - package-ecosystem: github-actions
@@ -154,5 +156,5 @@ updates:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
     labels:
-      - dependencies
-      - ci
+      - type:chore
+      - area:ci

.github/workflows/ci.yml

@@ -101,7 +101,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@v5
         with:
-          # Match the toolchain go.mod requires (go 1.25.x). Pinning an older
+          # Match the toolchain go.mod requires (go 1.26.x). Pinning an older
           # version forced a GOTOOLCHAIN auto-download whose tool set was
           # missing `covdata`, breaking `go test -cover` on no-test packages.
           go-version-file: go.mod
@@ -110,18 +110,17 @@ jobs:
         run: go vet ./...
       - name: go build
         run: go build ./...
-      # golangci-lint v2 (S7): the config was migrated from the v1 schema so it
-      # analyzes the go 1.25 toolchain cleanly again. It is restored as a
-      # blocking gate in only-new-issues mode — the ~106-issue pre-existing
-      # backlog is not gated, but any NEW issue a PR introduces fails the build,
-      # so the debt burns down as files are touched. Run ENFORCE via
-      # `golangci-lint run` locally to see the full backlog.
+      # golangci-lint v2 (S7): restored as a blocking gate in only-new-issues
+      # mode — the pre-existing backlog is not gated, but any NEW issue a PR
+      # introduces fails the build. Run ENFORCE via `golangci-lint run`
+      # locally to see the full backlog.
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v7
         with:
-          # v2.5.0's release binary is built with go1.25.1; older v2 binaries
-          # (e.g. v2.1.6, built with go1.24) refuse a config targeting go 1.25.
-          version: v2.5.0
+          # v2.13.1 is built with go1.27 and is the first release that can
+          # typecheck a go 1.26 module. v2.5.0 (go1.25) panics with
+          # "package requires newer Go version go1.26".
+          version: v2.13.1
           # Compute NEW issues from git, not the GitHub diff API. The action's
           # only-new-issues path fetches the PR patch from the API, which has a
           # hard 20k-line ceiling ("diff too large") — a large PR then trips it
@@ -142,7 +141,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
-          # Match the toolchain go.mod requires (go 1.25.x). Pinning an older
+          # Match the toolchain go.mod requires (go 1.26.x). Pinning an older
           # version forced a GOTOOLCHAIN auto-download whose tool set was
           # missing `covdata`, breaking `go test -cover` on no-test packages.
           go-version-file: go.mod

.github/workflows/security.yml

@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
           cache: true
       - name: Run gosec
         uses: securego/gosec@master

.golangci.yml

@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: "1.25"
+  go: "1.26"
 linters:
   default: none
   enable:

apps/dashboard/package.json

@@ -14,27 +14,27 @@
     "test:new-admin": "node scripts/verify-new-admin.mjs"
   },
   "dependencies": {
-    "@base-ui/react": "^1.6.0",
-    "@hookform/resolvers": "^5.4.0",
+    "@base-ui/react": "^1.7.0",
+    "@hookform/resolvers": "^5.9.0",
     "@tanstack/react-table": "^8.21.3",
-    "@types/pg": "^8.20.0",
-    "better-auth": "^1.6.23",
+    "@types/pg": "^8.21.0",
+    "better-auth": "^1.6.29",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "date-fns": "^4.4.0",
-    "kysely": "^0.29.3",
-    "lucide-react": "^1.23.0",
+    "kysely": "^0.29.5",
+    "lucide-react": "^1.31.0",
     "next": "16.3.4",
     "next-themes": "^0.4.6",
-    "pg": "^8.22.0",
-    "react": "19.2.7",
+    "pg": "^8.23.0",
+    "react": "19.2.8",
     "react-day-picker": "^10.0.1",
-    "react-dom": "19.2.7",
-    "react-hook-form": "^7.81.0",
-    "recharts": "3.9.2",
-    "shadcn": "^4.13.0",
-    "sonner": "^2.0.7",
+    "react-dom": "19.2.8",
+    "react-hook-form": "^7.85.0",
+    "recharts": "3.10.1",
+    "shadcn": "^4.18.0",
+    "sonner": "^2.0.8",
     "tailwind-merge": "^3.6.0",
     "tw-animate-css": "^1.4.0",
     "zod": "^4.4.3"
@@ -46,7 +46,7 @@
     "@types/react-dom": "^19",
     "eslint": "^9",
     "eslint-config-next": "16.3.4",
-    "playwright": "^1.61.1",
+    "playwright": "^1.62.1",
     "tailwindcss": "^4",
     "typescript": "^6"
   }