chore(deps): the bumps from Dependabot's #207, #206 and #11 that are shown safe, in tiers

[yulmucoffee]

What this changes

The version bumps from Dependabot's #207 (production group), #206 (development group) and #11 (eventsource) that can be shown safe, in one branch, in tiers — each tier gated on its own so a failure names its package. Every package left out is listed below with the reason. Besides package.json files and bun.lock, three source lines moved: the markdown renderer's word table gained the three words streamdown 2.7 draws on a diagram, with their Korean, and biome.json's $schema names the new biome.

Dependabot's own branches fail CI: #207's typecheck (copilot.ts:956, CopilotKit 1.77 changed the agents option's type) and build (genericOAuthClient is no longer exported by better-auth 1.7.7; authorizationUrlParams is no longer a function), and #206's app tests (205 failures). Read from gh run view --log-failed of runs 38175689937 and 38175493186. #207's lock also leaves streamdown 2.7.0 on remend 1.3.1, which the root overrides pins, and streamdown 2.7.0 imports a name remend 1.3.1 does not export — the app does not even start (measured here before the override moved, see Proof).

Package	From → to	In/out	How shown, or why left
yaml	2.9.0 → 2.9.1	in	gate (one copy now; main already resolved 2.9.1 nested for server, knip, agent-computer)
@shadcn/react	0.3.0 → 0.3.1	in	gate
remark-cjk-friendly	2.3.1 → 2.3.2	in	gate, and live (Korean replies with emphasis render)
drizzle-kit	0.31.10 → 0.31.11	in	gate (the suite migrates each test database with it), and the live database was migrated with it
drizzle-orm	0.45.2 → 0.45.3	in	gate, live
hono	4.13.7 → 4.13.13	in	gate, live; lock deduplicated so the MCP SDK and the runtime share the one copy (two copies disagree on Context in the typecheck, main.ts:1137)
@tanstack/react-router	1.170.27 → 1.170.41	in	gate, live (welcome → chat → settings)
@tanstack/router-plugin	1.168.30 → 1.168.42	in	gate (app pretypecheck regenerates the route tree with it)
@biomejs/biome	2.5.11 → 2.5.15	in	biome lint . reports the same 2 warnings as before and nothing new; format:check clean, nothing reformatted; biome.json's $schema moved to 2.5.15 (the only thing 2.5.15 said)
@types/bun	1.4.0 → 1.4.2	in	gate (typecheck)
@tabler/icons-react	3.46.0 → 3.48.0	in	gate, live (icons in the avatar menu)
@tanstack/react-query	5.101.4 → 5.104.1	in	gate, live
tailwind-merge	3.6.0 → 3.7.0	in	gate, live
zod	4.4.3 → 4.6.6	in	gate, live (one copy; @shadcn/registry keeps its own zod 3)
shadcn	4.17.0 → 4.21.1	in	gate (a CLI; brings @shadcn/registry)
knip	6.38.0 → 6.39.0	in	gate
@types/node	26.2.0 → 26.6.4	in	gate (typecheck)
@tauri-apps/cli	2.11.4 → 2.12.1	in	desktop typecheck; the shell was not built here
react, react-dom	19.2.8 → 19.3.0	in	gate, live: five real turns in headless Chrome; the choice card, a streamed reply, tables, lists, bold and the weather card drew; no page error (19.3's notes list no breaking change; its behaviour changes are hydration in Strict Mode, Trusted Types, form submitter, resize batching)
@types/react, @types/react-dom	19.2.x → 19.3.0	in	gate (typecheck); paired with react as #207 does
streamdown	2.5.0 → 2.7.0	in	gate, live: a streamed reply rendered past its first chunk and settled; a table drew with its Korean controls (표 복사 · 표 내려받기), a numbered list, bold. 2.7 draws three zoom buttons on a diagram, so markdown-words.ts gains resetView · zoomIn · zoomOut with Korean (a type error otherwise, by design)
remend (override)	^1.3.1 → ^1.4.0	in	streamdown 2.7.0 depends on remend 1.4.0 exactly and imports INCOMPLETE_IMAGE_PLACEHOLDER from it; the root overrides pinned ^1.3.1 (2af08cb, Korean emphasis against a particle), and with it in force Vite refused to start the app. The override keeps its purpose (nothing below 1.3.1) at ^1.4.0; the Korean-emphasis tests of the app are in the gate
@base-ui/react	1.7.0 → 1.8.0	in	gate, live: the avatar menu (base-ui Menu) opened with all its items; settings drew. 1.8.0's notes list no breaking change
@copilotkit/aimock	1.38.0 → 1.43.0	in	gate (agent-connection-live.test.ts is its one user; passes)
@happy-dom/global-registrator	20.11.2 → 20.14.5	out	the app suite does not finish with it: two gate workers sat under 1% CPU for seven minutes on account-copy.test.ts and draft.test.ts, and a direct run of the app suite was still not done after 22 minutes; both killed. #206's CI shows the same suite with 205 failures. (bun resolved ^20.14.5 to 20.14.6; not bisected further)
playwright	1.62.1 → 1.63.0	out	not this PR's: its version must equal the browser image in agent-computer/Dockerfile, which #22 bumps
@copilotkit/react-core, @copilotkit/runtime	1.67.1 → 1.77.0	out	needs a source change in server/src/copilot.ts (the agents factory's type changed; #207's typecheck fails there), which this PR may not touch; a deliberate upgrade of its own
better-auth, @better-auth/drizzle-adapter	1.6.27 → 1.7.7	out	needs source changes in sign-in: genericOAuthClient is gone from better-auth/client/plugins (#207's app build fails) and authorizationUrlParams is no longer a function (server/src/auth/index.ts:179); that is OAuth and sessions, which sign-in being off in dev cannot exercise
eventsource	3.0.7 → 5.1.1	out	the server depends on eventsource only so src/index.ts and scripts/test-preload.ts can evaluate the very copy the MCP SDK will require() before the boot race the comments there record. The SDK's range is ^3.0.2, so bumping the server's to 5 splits them into two copies (#11's lock nests eventsource@3.0.7 under the SDK) and the preload guards the wrong one — the race comes back and #11's green CI (one boot at a time) cannot see it
@modelcontextprotocol/sdk	1.30.0 → 1.32.0	out	1.32.0 makes the client transports follow same-origin redirects themselves, wrapping a caller's fetch (its PR 2902); server/src/plugins/mcp.ts sets redirect: "manual" and refuses every 3xx with an audit row (laf:mcp_redirect_refused), so the new behaviour would walk a same-origin redirect past that refusal. A deliberate change to a security path, not a bump
prompt-area	0.6.3 → 0.7.1	out	0.7.0 swaps its peer dependency to a new package cn (a new dependency), and 0.6.8 rewrites IME composition handling (Enter, keyCode 229, blur) — the Korean composer's path, which a headless check cannot type into. Not shown safe here
vite 8, @vitejs/plugin-react 6, TypeScript 7, openai 7	—	out	closed as deliberate upgrades, not in these groups

Where it runs

No new state, listener, port or schedule.

• New state that outlives a request? None.
• New listener, port, or schedule? None.
• Anything the deployment cannot honour? Nothing drawn.

Boundary and audit

No change to any acting call, refusal or record. The one bump that would have changed a boundary's behaviour (the MCP SDK's redirect handling) is left out for that reason.

• Every acting call still goes through the gateway.
• New refusals and new failures each write a row — none added.
• Nothing new is trusted from the client.
• Nothing new lets an action past a person.
• A Bot cannot write the rule that decides whether it gets asked about.
• Nothing new records a value somebody typed.

Korean

Three new words, the diagram zoom buttons streamdown 2.7 draws: "Reset the zoom" · "Zoom in" · "Zoom out" → 원래 크기로 · 확대 · 축소, in i18n-ko.ts beside the other renderer words.

• Every new user-facing string goes through t() (via MARKDOWN_WORDS), Korean in the same change.
• They are read through a variable; markdown-words.test.ts walks the table. With the "Zoom in" Korean line deleted that test fails (every one of them has Korean: 3 pass, 1 fail); restored, 4 pass.
• No server prose reaches the screen.

The gate

Run on the final head (rebased on main at c5d4ab2) with LAF_TEST_DB_SUFFIX=dp LAF_TEST_WORKERS=2, 2026-10-13 17:21–17:24 KST:

• bun run typecheck: every workspace exit 0.
• bunx biome lint .: 2 warnings and 1 info, the same as on main (server/tests/computer-browsers.test.ts:714 and unattended-facts.test.ts:343 noConfusingVoidType; agent-bot/tests/reasoning.test.ts:238 useIndexOf — fixable, not touched), 0 new.
• bun run format:check: clean.
• bun run test:ci: server 4671 / floor 4630 · app 2663 / 2446 · agent-computer 656 / 620 · root 1749 / 1714, exit 0.

Each tier was gated on its own before the next went in (tier 1+2 alone, before the rebase: 4671 · 2663 · 656 · 1747, exit 0; tier 3 before the rebase: the same).

• All four pass. No floor moved: no tests added.
• No test added; the one existing test the source change touches was shown failing (above).

Proof

Live, on this branch, a database of its own (openbot_dplive, migrated with drizzle-kit 0.31.11), server on :3411, Vite on :3412, headless Chrome through Playwright:

• First run → named a Bot → the greeting's choice card (학생/직장인/사장님/기타) drew.
• Five real turns (4 model runs recorded, $0.002 in laf_thread_runs.cost_usd): "안녕! 한 줄로 자기소개 해줘." answered in one line; "사과, 배, 감을 표 하나와 번호 목록으로…" drew a table with 표 복사 · 표 내려받기 · 크게 보기 controls, a numbered list and bold; "오늘 날씨 어때?" drew the weather card (서울특별시 · 위치를 아직 몰라요, the week's forecast, 출처: 기상청). The reply text was watched every 500 ms until it stopped changing — it rendered past its first chunk and settled.
• The avatar menu opened and listed 모두 멈추기 · 대화 · 소식 · 아이디어 · 목표 · 만든 것 · 수첩 · 루틴 · 스킬 · 연결 · 계정 · 도움말 · 관리 · 설정 · 로그아웃; /settings drew. Zero page errors in the console across both scripts (one 404 for a resource the dev server does not serve).
• Before the remend override moved, with chore(deps): Bump the production group across 1 directory with 23 updates #207's resolution: Vite's dependency optimisation failed with No matching export in "…/remend@1.3.1/…" for import "INCOMPLETE_IMAGE_PLACEHOLDER" from streamdown@2.7.0/dist/chunk-D32TOXHM.js and the page did not load (HTTP 000). After: 200 and everything above.
• Not exercised: a diagram (the three new words are drawn only on a Mermaid block), the desktop shell, sign-in (off in dev), the MCP and routine paths (no package touching them is in).

🤖 Generated with Claude Code

[codesolarlght]

🔆 CodeSolar review ✅ Looks good

Dependency bumps across the workspace, with source changes limited to markdown-words.ts (three zoom-button keys for streamdown 2.7), i18n-ko.ts (their Korean translations), and biome.json ($schema updated to 2.5.15). The root overrides remend bump from ^1.3.1 to ^1.4.0 resolves the streamdown 2.7 incompatibility. No issues visible in the diff.

✅ No issues worth flagging.

---

_{solar-pro4 (openrouter) · 7 files · +131/-122 · 119.6s · CodeSolar}

_{Comment /codesolar on this PR to re-run the review.}