chore: update dependencies to their latest compatible versions

[joshunrau]

Moves every dependency outside vendor/ to its newest release that clears the 7-day minimumReleaseAge and whose breaking changes need no code change here. React stays on 19.1, because the react19 catalog feeds vendor/.

Changes

chore commit

• 87 direct dependencies change version. The majors are:
  • @nestjs/jwt, passport and axios 12
  • mongodb 7, mongodb-memory-server 11, nodemailer 10, faker 10, msgpackr 2
  • esbuild 0.28 (bundled instrument output is byte-identical to 0.23), Vite 7, es-module-lexer 2, glob 13, commander 15, chalk 6
  • motion 13, react-dropzone 20, react-error-boundary 6, react-resizable-panels 3, immer 11, serialize-error 13
  • sirv 3, sqlite3 6, env-cmd 11, knip 6, prettier-plugin-tailwindcss 0.8, tailwind-merge 3
• Three new exact or tilde pins hold packages below a release that breaks this repo: Storybook 10.5.6, faker ~10.2.0, happy-dom ~20.11.15.
• The framer-motion override is replaced by fastify@5: ^5.12.5. @nestjs/platform-fastify 11.2.6 pins fastify to exactly 5.11.3, and without the override the server would miss the 5.12 security fixes.
• @types/nodemailer is dropped, because nodemailer 10 ships its own types.
• react-core's optional router peer floor is raised, so only one router version is installed.
• The Dockerfile turbo pins move to 2.11.5, and the agent-guidance block turbo writes to AGENTS.md is kept.

style commit

• Formatting only: Prettier 3.9, Tailwind classes re-sorted in v4 order, and route-tree.ts regenerated by the new router plugin (lines move, no route changes).

Not upgraded

Each of these has an issue with the exact reason and what is required:

• Needs code changes: Migrate authorization to @casl/ability 7 and @casl/prisma 2 #1611 (CASL), Upgrade @cap.js/server to 4.x, where createChallenge is async #1612 (cap.js), Upgrade recharts to 3.x, which needs react-is as a peer dependency #1613 (recharts), Upgrade lucide-react to 1.x, which removed GithubIcon #1614 (lucide), Upgrade monaco-editor past 0.54 in the playground #1615 (monaco), Upgrade react-resizable-panels to 4.x in the playground #1616 (resizable panels), Upgrade es-module-lexer to 3.x in instrument-bundler #1617 (es-module-lexer), Upgrade js-yaml to 5.x, which has no default export #1618 (js-yaml), Upgrade Vite to 8 #1622 (Vite 8), Upgrade typedoc to 0.28 in outreach for TypeScript 6 support #1623 (typedoc).
• Astro and Starlight: findings added to Upgrade outreach to Astro 7 (deferred security advisories) #1437.
• Regressions in newer releases: Upgrade Storybook past 10.5.6, where decorator args lose their types #1619 (Storybook), Upgrade @faker-js/faker past 10.2, where sexType() can return 'generic' #1620 (faker), Upgrade happy-dom past 20.11, whose Element.animate leaks unhandled rejections #1621 (happy-dom).
• Blocked by @douglasneuroinformatics/* peer ranges: Upgrade the API to NestJS 12 (blocked on libnest) #1624 (NestJS 12), Upgrade to Prisma 7 (blocked on libnest, esbuild-plugin-prisma and MongoDB support) #1625 (Prisma 7), Upgrade to Vitest 5 (blocked on libnest) #1626 (Vitest 5), Upgrade to ESLint 10 (blocked on eslint-config) #1627 (ESLint 10), Upgrade to TypeScript 7 (blocked on eslint-config and tsconfig) #1628 (TypeScript 7), Upgrade prettier-plugin-astro to 1.x (blocked on prettier-config) #1629 (prettier-plugin-astro).

Verification

• pnpm lint: 34/34 tasks pass.
• pnpm test: 179 files and 1,661 tests pass, with no unhandled errors.
• pnpm build: 13/13 tasks pass. It was run with RELEASE_VERSION set, because the api's production build requires it.
• pnpm test:e2e: 276 of 277 pass.

Exceptions:

• record-file-deletion.spec.ts fails locally. The local .env has no STORAGE_ENABLED, so the api returns 503 before reaching S3. This is unrelated to the upgrade.
• No new unit or e2e test. This is a dependency update, and the existing suites are the check.
• Not exercised:
  • production bundles at runtime (e2e runs against the dev servers)
  • Docker image builds
  • the Storybook UI
  • knip, which cannot run in this checkout

Co-Authored-By: Claude Opus 5.5 (1M context) noreply@anthropic.com