chore(deps): consolidate dependency bumps (#273, #260, #259, #258, #257, #256, #242)

[sirdeggen]

Summary

Consolidates all currently-open dependabot chore/dep-bump PRs into a single branch so CI runs once against the combined change set instead of 7 separate runs.

Cherry-picked cleanly (no conflicts) from:

• chore(deps): bump the bsv-workspace group across 1 directory with 38 updates #273 — chore(deps): bump the bsv-workspace group across 1 directory with 38 updates
• build(deps): bump the infra-deps group across 8 directories with 6 updates #242 — build(deps): bump the infra-deps group across 8 directories with 6 updates
• build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 #260 — build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0
• build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 #259 — build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 #258 — chore(deps): bump actions/checkout from 6.0.2 to 7.0.0
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 #257 — build(deps): bump actions/setup-go from 6.4.0 to 6.5.0
• build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 #256 — build(deps): bump actions/setup-python from 6.2.0 to 6.3.0

pnpm install --frozen-lockfile passes locally against the merged lockfiles.

Once this is green on CI and merged, the 7 source PRs above should be closed as superseded.

Test plan

• CI green on this PR
• pnpm install --frozen-lockfile verified locally

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​jest-fetch-mock@​4.2.0
	npm/​react-router-dom@​6.30.4 ⏵ 7.18.1	+3		-9	+1
	npm/​@​shikijs/​rehype@​4.3.1
	npm/​@​typescript-eslint/​parser@​8.63.0
	npm/​typescript-eslint@​8.63.0
	npm/​@​libp2p/​pnet@​3.0.24
	npm/​vite-react-ssg@​0.9.1
	npm/​vitest@​4.1.10
	npm/​@​typescript-eslint/​eslint-plugin@​8.63.0
	npm/​@​rspack/​core@​2.1.3
	npm/​@​types/​node@​26.0.0 ⏵ 26.0.1
	npm/​@​types/​node@​26.0.0 ⏵ 26.1.1	+1		+1	-1
	npm/​tsx@​4.23.1
	npm/​webpack@​5.108.4
	npm/​vite@​8.1.4
	npm/​globals@​17.7.0
	npm/​@​rspack/​cli@​2.1.3
	npm/​mermaid@​11.16.0
	npm/​typescript@​7.0.2
	npm/​mongodb@​7.3.0 ⏵ 7.5.0	-6			+1
	npm/​@​libp2p/​interface@​3.2.5
	npm/​fs-extra@​11.3.6
	npm/​@​libp2p/​crypto@​5.1.21
	npm/​@​libp2p/​peer-id@​6.0.12
	npm/​mysql2@​3.22.6
	npm/​@​vitejs/​plugin-react@​6.0.3
	npm/​@​libp2p/​ping@​3.1.8
	npm/​@​libp2p/​tcp@​11.0.23
	npm/​axios@​1.18.0 ⏵ 1.18.1	+1
	npm/​@​libp2p/​kad-dht@​16.3.4
	npm/​webpack-cli@​7.2.1
	npm/​knex@​3.3.0
See 9 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@rspack/core@2.1.3 → npm/vite@8.1.4 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm mermaid is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs-site/package.json → npm/mermaid@11.16.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mermaid@11.16.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm powershell-utils is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/webpack-dev-server@6.0.0 → npm/powershell-utils@0.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/powershell-utils@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: packages/helpers/did-client/package.json → npm/webpack@5.108.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.108.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[ty-everett]

Really tired of Dependabot! It should make ONE PR maybe every 3 weeks with all dep changes, not 9 PRs.

And if there is one PR already open it should not open a new one under any circumstances, it should always rebase the old one and it should update it with whatever it was going to do.

Otherwise none of these will ever get merged in a timely manner going forward.

QA issue on 24.x then this is approved

[sirdeggen]

Summary

This PR consolidates seven Dependabot bump PRs. Action SHAs look correct, but monorepo consolidation is incomplete and should be fixed before merge.

Blocking findings (cannot use Request changes on own PR — please treat as such):

1. Root pnpm.overrides still pin TypeScript ^6.0.3 while packages declare ^7.0.2; lockfile still resolves 6.0.3.
2. Root overrides still pin knex 3.2.10 / mysql2 3.22.3 while package.json files declare newer ranges.

Either complete the upgrades (overrides + lockfile) or revert the cosmetic bumps. See inline comments. Do not merge until these are addressed.

[sirdeggen]

[bug] Workspace packages (and docs-site / conformance runners) bump typescript to ^7.0.2, but the root package.json still has pnpm.overrides.typescript: "^6.0.3" (unchanged by this PR) and pnpm-lock.yaml importers still record specifier: ^6.0.3 / version: 6.0.3 (e.g. amountinator importer at lockfile L157–L159). CI jobs use pnpm install --frozen-lockfile (.github/workflows/ci.yml, docs-deploy.yml, release.yaml). That combination is either an outdated-lockfile install failure, or a silent no-op that never installs TypeScript 7 despite the package.json churn. The TypeScript 7 bump is therefore incomplete/inconsistent across the monorepo.

Suggestion: Either (a) complete the TS 7 upgrade by updating root pnpm.overrides.typescript to ^7.0.2 (or removing the pin), regenerating pnpm-lock.yaml so importers show specifier: ^7.0.2 and resolve 7.0.x, and validating tsc/jest/eslint against the Go-based TS 7 compiler; or (b) revert the per-package typescript range bumps until overrides + lockfile can be updated together. Do not land package.json ranges that disagree with the lockfile while frozen installs are required.

[sirdeggen]

[bug] Workspace packages bump knex to ^3.3.0 (wallet-toolbox, overlay, overlay-express) and mysql2 to ^3.22.6 (wallet-toolbox), but root pnpm.overrides still pin knex: "3.2.10" and mysql2: "3.22.3". The lockfile accordingly still resolves knex 3.2.10 and mysql2 3.22.3 (e.g. wallet-toolbox importer knex/mysql2 entries). Those package.json bumps are therefore cosmetic for the pnpm workspace and create a false sense that knex/mysql2 were upgraded in-app. Infra components (outside the pnpm workspace) do pick up knex 3.3.0 via their own package-locks, so runtime versions will diverge between monorepo packages and infra services after merge.

Suggestion: Update root pnpm.overrides for knex and mysql2 to match the intended ranges (or drop the pins if no longer needed), run pnpm install to refresh the lockfile, and re-verify storage/migration tests. If the overrides must stay for compatibility, do not bump the package.json ranges in this PR—leave them consistent with the forced versions.

[sirdeggen]

[suggestion] Even after fixing Issue 1, TypeScript 6 → 7 is a major compiler rewrite (native/Go tsc) with ecosystem breakage risk for tools this repo relies on (ts-jest, typescript-eslint, ts-node, tsup, ts-standard, dual-package tooling). Package.json files already pin ecosystem tools that historically depend on the TypeScript JS API; a pure Dependabot range bump without a green full build/test matrix is high-risk for a consolidation PR.

Suggestion: Treat TS 7 as its own migration PR after CI is green on lockfile consistency. Confirm peer support from typescript-eslint / ts-jest / rspack, run full workspace build + test + lint, and document any required config/default changes (TS 6 deprecations become hard errors in 7).

[sirdeggen]

[suggestion] chalk is bumped from ^4.1.2 to ^5.6.2 in wallet-toolbox. Chalk 5 is ESM-only; the only consumer found is a Jest test (test/Wallet/action/createAction2.test.ts uses import chalk from 'chalk'). Depending on Jest/ts-jest ESM configuration, this can fail at runtime even though TypeScript may still typecheck.

Suggestion: Confirm the wallet-toolbox test suite imports chalk successfully under the current Jest config. If not, keep chalk 4 for CJS tests or enable the necessary ESM interop for that package.

[sirdeggen]

[suggestion] react-router-dom major bump ^6.28.0 → ^7.18.1 for the docs site. v7 keeps a compatibility surface for many v6 DOM APIs, and current imports (Link, NavLink, Outlet, useLocation, RouteObject) are still re-exported, so this is likely fine—but it is still a major framework bump in a static docs SSG path (vite-react-ssg) and should not ride silently inside a deps-consolidation PR without a docs build verification.

Suggestion: Ensure the docs-validate / docs-deploy jobs pass on this branch (they should), and skim for any future-flag or loader-related deprecations if the site later adopts data APIs. No code change required if the existing docs CI is green.

[sirdeggen]

[suggestion] Two major bumps land together in message-box-client: jest-fetch-mock ^3.0.3 → ^4.2.0 and webpack-dev-server ^5.2.5 → ^6.0.0. These are not covered by the root overrides story and will actually resolve if the lockfile matches (webpack-dev-server does appear updated in the lockfile). Either can break local test/dev scripts even if production builds are unaffected.

Suggestion: Run message-box-client tests and any webpack-dev-server-based demo/dev scripts after install. If unused, consider dropping webpack-dev-server rather than major-bumping it in a bulk PR.

[sirdeggen]

[nit] All workflows pin actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0, which is the verified v7.0.0 release commit, but most comments still say # v6 (ci.yml, codegen.yml, conformance.yml, infra-release.yaml, release.yaml, wab-marketplace-release.yml). Only docs-deploy.yml correctly comments # v7.0.0. The pin itself is fine and consistent; the version comments are misleading for future audits.

Suggestion: Update every checkout pin comment to # v7.0.0 (or # v7) so SHA annotations match the actual major.

[sirdeggen]

[nit] actions/setup-python is bumped to SHA ece7cb06caefa5fff74198d8649806c4678c61a1 (correct for v6.3.0) but the trailing comment remains only # v6 instead of # v6.3.0. Same pattern as other minor action bumps—low impact, but reduces pin auditability.

Suggestion: Annotate as # v6.3.0 (and setup-go as # v6.5.0) for consistency with the codecov pin style (# v7.0.0).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Closing as superseded by #313 and the coordinated plan in #310. The replacement incorporates the actionable review feedback here: it removes the broad root TypeScript/database overrides that masked package compatibility, consolidates all supported ecosystems into one monthly maintenance PR, limits the stream to one open PR, and keeps it automatically rebased. #313 also adds dependency review, high/critical audit enforcement, Socket/CodeQL/Sonar/Codecov gates, and a protected release path. This PR is conflicted and should not be merged.