[yultyyev]

What

Bumps every npm dependency to its latest release, pnpm from 10 to 12.16.1, and the GitHub Actions in CI and release to their latest majors.

Majors:

• execa 10, tsup 9, vitest 5
• @semantic-release/changelog 7: now ESM, needs semantic-release ≥ 20.1 (we're on 25)
• pnpm 12
• actions/checkout v7, actions/setup-node v7, pnpm/action-setup v6 (v6.1 adds pnpm 12 support)

Minors and patches: biome 2.6, hono 4.13, @hono/node-server 2.1, @modelcontextprotocol/sdk 1.32, zod 4.6, react / react-dom 19.3, vite 8.3, @vitejs/plugin-react 6.1, tsx, open, semantic-release and its plugins.

pnpm 12 migration:

• pnpm 11 stopped reading the pnpm field in package.json and removed onlyBuiltDependencies. The build-script allowlist (@biomejs/biome, esbuild, ffmpeg-static) moves to allowBuilds in a new pnpm-workspace.yaml.
• strictDepBuilds is now on by default, so a new dependency with an install script fails the install until someone allows it.
• pnpm 12 defaults to a one-day minimumReleaseAge, and it rejected the first lockfile: pnpm 10's update --latest had locked rollup 4.66.0 binaries published the same day. I re-resolved the lockfile under the policy (rollup is now 4.65.1); direct dependency versions didn't change. Expect pnpm add and pnpm update to skip anything less than a day old from now on.
• pnpm install --frozen-lockfile false is no longer accepted. Nothing in the repo uses it.

Held back on purpose:

• typescript stays on 6.0.3. TS 7 type-checks this repo cleanly, but pnpm build fails: tsup 9.0.0's .d.ts step calls ts.parseJsonConfigFileContent, which TS 7 no longer ships. Adding @typescript/typescript6 doesn't help, because tsup calls it outside rollup-plugin-dts's fallback. See docs/backlog/typescript-7.md.
• @types/node stays on 24.x (24.19.2) to match engines: >=24. The 26.x types would let code use APIs that Node 24 doesn't have.

Config:

• biome migrate renamed rules.recommended to rules.preset.
• Biome 2.6 starts formatting Markdown, which would reflow README, SKILL.md and RELEASING.md (table padding, *em* → _em_). This PR turns markdown.formatter off to keep the old behavior; turning it on is a separate change.

Why

Routine dependency refresh. CI was also running checkout/setup-node v4 while release ran v6.

Release note

This PR does not release on its own. Its commits use unscoped chore: instead of chore(deps):, so .releaserc.json's chore(deps) → patch rule doesn't fire. That lets the open PRs land as a single release: merge this one and the docs PR in any order, then merge the fix(ffmpeg) escaping PR last, which cuts one patch release that includes these bumps. Verified with @semantic-release/commit-analyzer and this repo's config:

• These 5 commits → no release.
• A chore(deps) control → patch.
• fix(ffmpeg) → patch.

Merge with a merge commit or squash; either keeps the unscoped subject.

That first release is also the first real run of the bumped release chain (pnpm 12, semantic-release 25.0.9, changelog v7, setup-node v7). setup-node v7 drops its dummy NODE_AUTH_TOKEN export (actions/setup-node#1558). That change targets OIDC trusted publishing, which this repo uses, but watch that release run.

Checks

All run on the PR tip with Node 24.15.0 / pnpm 12.16.1:

• rm -rf node_modules && pnpm install --frozen-lockfile: ok. All three allowed build scripts ran; the ffmpeg-static binary is present.
• pnpm lint: 0 errors, 7 warnings (the same 7 warnings as main)
• pnpm type-check: ok, both tsconfigs
• pnpm test: 548/548 passed, the same count as a main baseline run
• pnpm build: ok
  • dist/cli.d.ts is identical to main.
  • dist/index.d.ts differs only cosmetically: union member order, and type exports split into an export type {} block.
• End-to-end CLI against bundled FFmpeg, exercising execa 10 on a clip named in put's.mp4:
  • ingest, trim, add_text and preview all succeeded.
  • A missing input still raises the probe error.
  • trim re-run after the pnpm 12 rebuild also succeeded.
• UI server smoke test (startUiServer): / returns the built page and /api/tools returns 200 JSON.
• Codex review (codex review --base origin/main, gpt-6.1-sol), run twice (before and after the pnpm 12 commit): no actionable regressions, no findings to fix or rebut. Its sandbox couldn't run the full suite or build, which ran locally above.

[github-actions]

🎉 This PR is included in version 0.3.1 🎉

The release is available on:

• v0.3.1
• GitHub release

Your semantic-release bot 📦🚀