Upgrade dependencies and add security audit configuration (#349)

Dockerfile.selfhost

@@ -8,7 +8,7 @@ WORKDIR /app
 
 RUN corepack enable && corepack prepare pnpm@10.30.1 --activate
 
-COPY package.json pnpm-lock.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile
 
 COPY . .

package.json

@@ -72,29 +72,29 @@
     "@every-app/sdk": "^0.1.14",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@openrouter/ai-sdk-provider": "^2.9.0",
-    "@tanstack/query-core": "^5.90.9",
+    "@tanstack/query-core": "^5.101.2",
-    "@tanstack/react-form": "^1.25.0",
+    "@tanstack/react-form": "^1.33.0",
-    "@tanstack/react-query": "^5.90.9",
+    "@tanstack/react-query": "^5.101.2",
-    "@tanstack/react-router": "^1.168.10",
+    "@tanstack/react-router": "^1.170.16",
-    "@tanstack/react-router-devtools": "^1.166.11",
+    "@tanstack/react-router-devtools": "^1.167.0",
-    "@tanstack/react-start": "^1.167.16",
+    "@tanstack/react-start": "^1.168.26",
     "@tanstack/react-table": "^8.21.3",
     "agents": "0.17.3",
     "ai": "^6.0.199",
-    "autumn-js": "^1.1.7",
+    "autumn-js": "^1.2.33",
-    "better-auth": "^1.5.5",
+    "better-auth": "^1.6.22",
     "cheerio": "^1.2.0",
     "cloudflare": "^5.2.0",
     "daisyui": "^5.5.5",
     "dataforseo-client": "^2.0.19",
-    "drizzle-orm": "^0.44.4",
+    "drizzle-orm": "^0.45.2",
     "fast-xml-parser": "^5.4.1",
     "jose": "^6.0.12",
     "lucide-react": "^0.542.0",
     "papaparse": "^5.5.3",
     "postgres": "^3.4.9",
-    "posthog-js": "^1.363.5",
+    "posthog-js": "^1.395.0",
-    "posthog-node": "^5.28.5",
+    "posthog-node": "^5.38.6",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "react-markdown": "^10.1.0",
@@ -108,29 +108,29 @@
     "zod": "^4.1.12"
   },
   "devDependencies": {
-    "@cloudflare/vite-plugin": "^1.40.2",
+    "@cloudflare/vite-plugin": "^1.42.3",
     "@cloudflare/workers-types": "^4.20260611.1",
     "@libsql/client": "^0.15.15",
     "@playwright/test": "^1.59.1",
     "@tailwindcss/vite": "^4.1.11",
-    "@tanstack/devtools-vite": "^0.6.0",
+    "@tanstack/devtools-vite": "^0.6.1",
-    "@tanstack/react-devtools": "^0.10.1",
+    "@tanstack/react-devtools": "^0.10.8",
     "@types/node": "^22.18.13",
     "@types/papaparse": "^5.5.2",
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^4.6.0",
-    "drizzle-kit": "^0.31.4",
+    "drizzle-kit": "^0.31.10",
-    "knip": "^5.66.4",
+    "knip": "^5.88.1",
     "oxlint": "^1.50.0",
     "oxlint-tsgolint": "^0.15.0",
     "portless": "^0.5.2",
     "prettier": "^3.6.2",
-    "tsx": "^4.21.0",
+    "tsx": "^4.22.4",
     "typescript": "^5.9.3",
-    "vite": "^7.1.2",
+    "vite": "^7.3.6",
     "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^3.2.4",
+    "vitest": "^3.2.6",
-    "wrangler": "^4.100.0"
+    "wrangler": "^4.105.0"
   }
 }

pnpm-workspace.yaml

@@ -1,3 +1,44 @@
 minimumReleaseAge: 11520
 minimumReleaseAgeExclude:
   - "@every-app/*"
+
+# Advisories triaged as not applicable. Re-review when the parent updates.
+# - GHSA-67mh-4wv8-2f99: esbuild <=0.24.2 dev-server CORS. Only reachable via
+#   drizzle-kit's bundled @esbuild-kit loader (dev-time CLI); drizzle-kit never
+#   starts esbuild's serve mode, so the vulnerable path cannot execute.
+auditConfig:
+  ignoreGhsas:
+    - GHSA-67mh-4wv8-2f99
+
+# Security floors (added 2026-07) for transitive deps with published advisories
+# where the parent hasn't shipped a bump yet. Each range sits inside what the
+# parent already declares, so these are lockfile nudges, not forks. Ranges are
+# major-bounded (^) on purpose: an override REPLACES the parent's range, so an
+# open-ended >= floor would let a future major (e.g. hono 5) get forced onto a
+# parent that only supports the current one.
+#
+# To prune once a parent catches up: delete the line, run `pnpm install`, and
+# keep it deleted if `pnpm audit` stays clean.
+overrides:
+  # GHSA-4x5r-pxfx-6jf8 — waiting on @tanstack/devtools-vite
+  "@babel/core": "^7.29.6"
+  # GHSA-737v-mqg7-c878 — waiting on better-auth
+  defu: "^6.1.5"
+  # 13 advisories incl. GHSA-x4vx-rjvf-j5p4, GHSA-gvmj-g25r-r7wr — waiting on posthog-js
+  dompurify: "^3.4.11"
+  # GHSA-hmw2-7cc7-3qxx — waiting on cloudflare
+  form-data: "^4.0.6"
+  # 9 advisories incl. GHSA-88fw-hqm2-52qc (CORS) — waiting on @modelcontextprotocol/sdk
+  hono: "^4.12.25"
+  # GHSA-v6wh-96g9-6wx3 — waiting on @tanstack/devtools-vite
+  launch-editor: "^2.14.1"
+  # GHSA-qx2v-qp2m-jg93 — waiting on vite
+  postcss: "^8.5.10"
+  # GHSA-q8mj-m7cp-5q26 — waiting on @modelcontextprotocol/sdk
+  qs: "^6.15.2"
+  # GHSA-w7jw-789q-3m8p — waiting on @tanstack/devtools-vite
+  shell-quote: "^1.8.4"
+  # GHSA-v3rj-xjv7-4jmq — waiting on knip
+  smol-toml: "^1.6.1"
+  # 7 advisories incl. GHSA-vmh5-mc38-953g — waiting on cheerio + miniflare
+  undici: "^7.28.0"