chore(deps): deferred majors — Templates dir wave + terraform provider (2026-08-14)

[stevenfackley]

From the 2026-08-14 fleet sweep. Main-app minors were merged or rebase-poked for auto-merge; these majors are deferred pending deliberate decisions:

Templates content (product decision, not dep hygiene — the templates ARE the product's output):

• typescript 5.x → 7.0.2 across V0/V1/V2/Tier3 template dirs: deps(npm)(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /src/StackAlchemist.Templates/V2-Python-React/frontend #278, deps(npm)(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /src/StackAlchemist.Templates/V2-DotNet-NextJs/nextjs #275, deps(npm)(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /src/StackAlchemist.Templates/V1-Python-React/frontend #274, deps(npm)(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /src/StackAlchemist.Templates/V1-DotNet-NextJs/nextjs #271, deps(npm)(deps-dev): bump typescript from 5.7.3 to 7.0.2 in /src/StackAlchemist.Templates/V0-Spark-NextJs #270, deps(npm)(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /src/StackAlchemist.Templates/Tier3-Infrastructure/infra/cdk #267
• @types/node 22 → 26: deps(npm)(deps-dev): bump @types/node from 22.20.1 to 26.2.0 in /src/StackAlchemist.Templates/V2-DotNet-NextJs/nextjs #277, deps(npm)(deps-dev): bump @types/node from 22.20.1 to 26.2.0 in /src/StackAlchemist.Templates/V1-DotNet-NextJs/nextjs #273, deps(npm)(deps-dev): bump @types/node from 22.10.5 to 26.2.0 in /src/StackAlchemist.Templates/V0-Spark-NextJs #269, deps(npm)(deps-dev): bump @types/node from 22.20.1 to 26.2.0 in /src/StackAlchemist.Templates/Tier3-Infrastructure/infra/cdk #266
• next 15.5 → 16.2: deps(npm)(deps): bump next from 15.5.23 to 16.3.0 in /src/StackAlchemist.Templates/V2-DotNet-NextJs/nextjs #276, deps(npm)(deps): bump next from 15.5.23 to 16.3.0 in /src/StackAlchemist.Templates/V1-DotNet-NextJs/nextjs #272, deps(npm)(deps): bump next from 15.5.21 to 16.3.1 in /src/StackAlchemist.Templates/V0-Spark-NextJs #268
• docker bases (node 24→26-alpine, python 3.12→3.14-slim): deps(docker): bump node from 24-alpine to 26-alpine in /src/StackAlchemist.Templates/V2-Python-React/infra #256, deps(docker): bump python from 3.12-slim to 3.14-slim in /src/StackAlchemist.Templates/V2-Python-React/infra #254, deps(docker): bump node from 24-alpine to 26-alpine in /src/StackAlchemist.Templates/V1-Python-React/infra #253, deps(docker): bump python from 3.12-slim to 3.14-slim in /src/StackAlchemist.Templates/V1-Python-React/infra #252, deps(docker): bump node from 24-alpine to 26-alpine in /src/StackAlchemist.Templates/V1-DotNet-NextJs/infra #251

Decide once what stack versions the generated templates should target, then take the whole wave together — piecemeal merges leave templates internally inconsistent.

Infra:

• deps(terraform): update hashicorp/aws requirement from ~> 5.84 to ~> 6.58 in /src/StackAlchemist.Templates/Tier3-Infrastructure/infra/terraform #282 terraform hashicorp/aws ~>5.84 → ~>6.58 (Tier3 template infra) — provider major, needs a plan-diff review like the undertow-engine one (undertow-engine#205).

[stevenfackley]

#267 was the last open PR from the Templates-content majors wave listed here (typescript 5.9.3 -> 7.0.2 in Tier3-Infrastructure/infra/cdk); its Backend build check was failing (V1TemplateCompileTests render->docker build). Closed it via `@dependabot close`.

#317 (merged) adds an `ignore:` block for typescript, @types/node, and next semver-major bumps to the Templates-dir npm dependabot.yml entry, referencing this issue. Dependabot won't re-file this wave until the ignore is removed, i.e. until this issue is decided.

[stevenfackley]

2026-09-22 sweep: more template-dir framework majors deferred into this wave. They are being closed and blocked with major-only ignores on the templates npm block. Minors and patches still come through.

• tailwindcss 3 -> 4: deps(npm)(deps-dev): bump tailwindcss from 3.4.19 to 4.3.3 in /src/StackAlchemist.Templates/V1-DotNet-NextJs/nextjs #326 (V1-DotNet), deps(npm)(deps-dev): bump tailwindcss from 3.4.19 to 4.3.3 in /src/StackAlchemist.Templates/V1-Python-React/frontend #328 (V1-Python), deps(npm)(deps-dev): bump tailwindcss from 3.4.19 to 4.3.3 in /src/StackAlchemist.Templates/V2-DotNet-NextJs/nextjs #333 (V2-DotNet), deps(npm)(deps-dev): bump tailwindcss from 3.4.19 to 4.3.3 in /src/StackAlchemist.Templates/V2-Python-React/frontend #334 (V2-Python). Every template still uses a v3 tailwind.config.ts. v4 moves config into CSS and swaps the PostCSS plugin to @tailwindcss/postcss, so this is a real migration. deps(npm)(deps-dev): bump tailwindcss from 3.4.19 to 4.3.3 in /src/StackAlchemist.Templates/V1-DotNet-NextJs/nextjs #326 already reds V1TemplateCompileTests (Backend .NET Build & Test), the only template gate.
• tailwind-merge 2 -> 3: deps(npm)(deps): bump tailwind-merge from 2.6.1 to 3.6.0 in /src/StackAlchemist.Templates/V1-DotNet-NextJs/nextjs #324 (V1-DotNet), deps(npm)(deps): bump tailwind-merge from 2.6.1 to 3.6.0 in /src/StackAlchemist.Templates/V2-DotNet-NextJs/nextjs #332 (V2-DotNet). v3 targets Tailwind v4 class semantics, so it has to land with or after the tailwind 4 migration. Neither build would catch a mismatch.
• eslint 9 -> 10: deps(npm)(deps-dev): bump eslint from 9.39.5 to 10.10.0 in /src/StackAlchemist.Templates/V1-DotNet-NextJs/nextjs #325 (V1-DotNet), deps(npm)(deps-dev): bump eslint from 9.39.5 to 10.10.0 in /src/StackAlchemist.Templates/V1-Python-React/frontend #329 (V1-Python), deps(npm)(deps-dev): bump eslint from 9.39.5 to 10.10.0 in /src/StackAlchemist.Templates/V2-DotNet-NextJs/nextjs #331 (V2-DotNet), deps(npm)(deps-dev): bump eslint from 9.39.5 to 10.10.0 in /src/StackAlchemist.Templates/V2-Python-React/frontend #335 (V2-Python). The flat-config plugins (eslint-plugin-react via eslint-config-next) break on ESLint 10. The Web app pins eslint ^9 for the same reason.
• lucide-react 0.511 -> 1.x: deps(npm)(deps): bump lucide-react from 0.511.0 to 1.41.0 in /src/StackAlchemist.Templates/V1-DotNet-NextJs/nextjs #327 (V1-DotNet), deps(npm)(deps): bump lucide-react from 0.511.0 to 1.41.0 in /src/StackAlchemist.Templates/V2-DotNet-NextJs/nextjs #330 (V2-DotNet). No template uses the brand icons that 1.0 removed, so this one is probably safe. It is held only to keep the templates' stacks consistent, per this issue.

Proposed order once the target stack is chosen: (1) typescript/@types/node/next per above, (2) tailwindcss 4 plus tailwind-merge 3 together per template, (3) lucide-react 1.x, (4) eslint 10 once eslint-config-next supports it. Land #313 (lockfiles + compile tests for V0/V2) first so V2 bumps are gated at all.

[stevenfackley]

Addendum 2026-09-22: #396-#399 (V1-Python-React: @eslint/js 10, eslint-plugin-react-hooks 7, globals 17, @vitejs/plugin-react 6, which needs vite 8) are deferred here too. #400 adds major-only ignores for those four plus vite. Order: take them with step (4) eslint 10, and move vite 8 together with @vitejs/plugin-react 6.