[grist-worker]

Why

Routine dependency maintenance. Everything is moved to its latest version, known security advisories are resolved and overrides that are no longer needed are removed.

What

Upgrades

Package	From	To
@envelop/graphql-modules	^9.2.0	^10.0.0
@graphql-tools/load-files	^7.0.1	^8.0.6
dotenv	^17.4.2	^18.0.9
graphql-yoga	^5.23.0	^6.0.0
typescript (root, server)	^6.0.3	^7.0.2
vite-plugin-pwa	^1.3.0	^2.0.0

Patch and minor bumps (43 more)

Package	From	To
@biomejs/biome	^2.5.13	^2.6.2
@radix-ui/react-collapsible	^1.1.20	^1.2.1
@radix-ui/react-dialog	^1.1.23	^1.3.1
@radix-ui/react-dropdown-menu	^2.1.24	^2.2.1
@radix-ui/react-scroll-area	^1.2.18	^1.4.0
@radix-ui/react-select	^2.3.7	^2.4.1
@radix-ui/react-separator	^1.1.15	^1.2.0
@radix-ui/react-slot	^1.3.3	^1.5.0
@radix-ui/react-switch	^1.3.7	^1.4.1
@tanstack/react-table	^9.2.4	^9.3.1
@types/node	^26.5.1	^26.6.5
bullmq	^6.3.4	^6.4.0
express	^5.2.1	^5.3.0
graphql-ws	^6.2.1	^6.4.1
lefthook	^2.1.12	^2.2.2
lucide-react	^1.45.0	^1.61.0
radix-ui	^1.6.7	^1.8.1
react-router	^8.3.1	^8.5.0
shadcn	^4.21.0	^4.22.1
turbo	^2.10.12	^2.11.10
ws	^8.21.3	^8.22.0
@apollo/client	^4.3.0	^4.3.5
@bull-board/api	^9.10.1	^9.10.5
@bull-board/express	^9.10.1	^9.10.5
@graphql-codegen/cli	^7.4.1	^7.4.6
@graphql-codegen/graphql-modules-preset	^6.1.0	^6.1.3
@graphql-codegen/schema-ast	^6.1.0	^6.1.1
@graphql-codegen/typescript-resolvers	^6.1.0	^6.1.1
@radix-ui/react-label	^2.1.15	^2.1.17
@types/ws	^8.18.1	^8.18.2
@vitejs/plugin-react	^6.1.1	^6.1.2
drizzle-kit	^0.31.10	^0.31.11
drizzle-orm	^0.45.2	^0.45.4
gql.tada	^1.11.3	^1.11.4
graphql-scalars	^2.0.0	^2.0.1
jotai	^3.0.0	^3.0.1
parse-duration	^2.1.8	^2.1.9
react	^19.3.0	^19.3.1
react-dom	^19.3.0	^19.3.1
tsc-alias	^1.9.5	^1.9.9
tsx	^4.23.13	^4.23.15
vite	^8.3.0	^8.3.5
zod	^4.6.4	^4.6.7

Code changes required by the upgrades

• apps/web/src/layouts/dashboard-layout.tsx: Biome 2.6 added lint/correctness/noComponentHookFactories, which flagged NavigationLinks, FooterLinks and NavBarHeader because they were defined inside DashboardLayout. I moved them to module level. NavigationLinks now gets groups and pathname as props.
• biome.json: $schema bumped to 2.6.2 via biome migrate.
• apps/web/package.json: typescript stays on ^6.0.3 for web only, see "Still open".

Security

Advisory	Package	Severity	Resolution
GHSA-rj75-hqrm-r3gf	postcss-selector-parser 6.0.10 (via @tailwindcss/typography 0.5.20, prod)	moderate	scoped override @tailwindcss/typography>postcss-selector-parser: ^7.1.6, resolves to 7.1.7

@tailwindcss/typography pins postcss-selector-parser to exactly 6.0.10 and has no newer release. The only 7.0 breaking change is about safe insertions during iteration, which the plugin isn't affected by (see tailwindlabs/tailwindcss-typography#429). I compared the built web CSS before and after the override and it's byte-identical (md5 a816f91149ea6b7f8d92dc5c8b5e47cf).

Removed overrides and pins

Entry	Was there for	Why it can go
serialize-javascript@<7.0.5: '>=7.0.5'	GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v via workbox-build > @rollup/plugin-terser (added in #67)	@rollup/plugin-terser 1.0.2 now pulls 7.1.2 on its own, audit stays clean without it
rollup devDependency in apps/web	GHSA-mw96-cpmx-2vgc, the override didn't reach the auto-installed rollup peer of workbox-build / @mdx-js/rollup (added in #67)	the auto-installed peer now resolves to 4.65.0, audit and web CSS output unchanged without it
patches/graphql-modules.patch	old graphql-modules patch	not referenced anywhere, only patches/graphql-modules@3.1.2.patch is wired up in patchedDependencies

Checked and kept:

• esbuild@<=0.24.2: '>=0.25.0' is still needed. Without it drizzle-kit 0.31.11 > @esbuild-kit/esm-loader > @esbuild-kit/core-utils 3.3.2 pulls esbuild 0.18.20 again (GHSA-67mh-4wv8-2f99).
• graphql-modules: 3.1.2 exact pin plus patchedDependencies is still needed. Without the patch tsc fails with TS7016 because the package exports don't expose types. 3.1.2 is also the latest stable release, the patch is version keyed, hence the pin stays.

pnpm dedupe --check had nothing to collapse.

Still open

Item	Current	Wanted	Blocker
typescript in apps/web	6.0.3	7.0.2	TS 7 is the native port and ships no JS compiler API. @gql.tada/cli-utils 1.9.4 (used by gql-tada generate output in the web build) calls ts.parseConfigFileTextToJson and crashes, and @0no-co/graphqlsp 1.17.5 only supports typescript ^5 || ^6. Root and server are on 7.0.2.
braces (GHSA-vfj7-8cjw-p6xm, high)	3.0.3	none, no patched version exists (<0.0.0)	dev only, via @graphql-codegen/cli 7.4.6 > @graphql-tools/* loaders / globby 11 > fast-glob / micromatch 4.0.8. Nothing to upgrade to, needs upstream to drop micromatch or a fix in braces.
graphql-modules peer graphql	3.1.2	a release supporting graphql 17	unmet peer graphql@^14 || ^15 || ^16, found 17.0.2. Already the case on main, server works fine at runtime.
deprecated subdeps @esbuild-kit/core-utils 3.3.2, @esbuild-kit/esm-loader 2.6.5	-	-	pulled in by drizzle-kit 0.31.11 (latest), this is also why the esbuild override stays

Verification

Same commands as .github/workflows/build.yml:

• pnpm install - pass
• pnpm check - pass
• pnpm build (turbo run build: server codegen + tsc + tsc-alias, web codegen + tsc -b + vite build) - pass. Codegen output didn't change.
• pnpm test - pass, but note there are no test tasks in any workspace, so turbo runs nothing
• pnpm audit - 1 advisory left (braces, dev only, no fix available), see above

On top I started the built server with database and redis disabled and queried { health { __typename } } on /graphql to check the graphql-yoga 6 / @envelop/graphql-modules 10 / dotenv 18 / @graphql-tools/load-files 8 majors at runtime. Returned 200 without errors.

The run was done by an agent in a sandbox with 1 GiB memory. That's why turbo ran with TURBO_ENV_MODE=loose (strict mode dropped the proxy vars so corepack couldn't fetch pnpm) and pnpm build was invoked as turbo run build directly, because the web vite build peaks at roughly 800 MB RSS. I checked: it's the same with vite 8.3.0 and vite-plugin-pwa 1.3.0, so it's not a regression from this PR. CI isn't affected by either.