Patch audited dependencies and retain disposable integration evidence

.github/workflows/verify.yml

@@ -21,6 +21,18 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm run init
       - run: docker compose up -d --wait db
+      - name: Record exact disposable integration runtime
+        run: |
+          mkdir -p work
+          {
+            git rev-parse HEAD
+            node --version
+            pnpm --version
+            docker --version
+            docker compose version
+            docker compose exec -T db postgres --version
+            docker image inspect postgres:17.9-alpine --format '{{json .RepoDigests}}'
+          } > work/integration-runtime.txt
       - run: pnpm db:generate && pnpm db:migrate && pnpm build
       - run: pnpm exec tsc --noEmit && pnpm test && pnpm audit --prod
       - run: pnpm exec playwright install --with-deps chromium
@@ -58,10 +70,12 @@ jobs:
           if-no-files-found: error
           overwrite: true
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: always()
         with:
           name: tally-sdk-and-verification
           path: |
             artifacts/*.tgz
+            work/integration-runtime.txt
             work/integration-results.json
             work/independent-results.json
             work/operations-results.json
@@ -71,7 +85,7 @@ jobs:
             docs/PERFORMANCE.json
             docs/DEPENDENCIES.json
       - if: always()
-        run: docker compose --profile app down
+        run: docker compose --profile app down --volumes --remove-orphans
   publish:
     name: Publish verified release
     needs: verify

apps/reference-app/package.json

@@ -13,9 +13,9 @@
   "dependencies": {
     "@tally-local/sdk": "workspace:*",
     "@tally-local/shared": "workspace:*",
-    "next": "16.3.8",
+    "next": "16.4.1",
     "react": "19.2.8",
     "react-dom": "19.2.8",
-    "zod": "4.5.4"
+    "zod": "4.6.6"
   }
 }

apps/tally/package.json

@@ -15,13 +15,13 @@
     "@tailwindcss/postcss": "4.3.3",
     "@tally-local/sdk": "workspace:*",
     "@tally-local/shared": "workspace:*",
-    "better-auth": "1.7.3",
+    "better-auth": "1.7.7",
     "lucide-react": "^0.577.0",
-    "next": "16.3.8",
+    "next": "16.4.1",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "recharts": "3.10.1",
     "tailwindcss": "4.3.3",
-    "zod": "4.5.4"
+    "zod": "4.6.6"
   }
 }

package.json

@@ -27,18 +27,19 @@
   },
   "dependencies": {
     "@prisma/client": "6.19.3",
-    "better-auth": "1.7.3",
-    "zod": "4.5.4"
+    "better-auth": "1.7.7",
+    "zod": "4.6.6"
   },
   "devDependencies": {
     "@playwright/test": "1.63.0",
     "@types/node": "^24.0.0",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
     "prisma": "6.19.3",
-    "tsx": "^4.21.0",
     "tsup": "8.5.1",
+    "tsx": "^4.21.0",
     "typescript": "5.9.3",
-    "vitest": "4.1.11"
+    "vite": "8.2.4",
+    "vitest": "4.1.12"
   }
 }

packages/shared/package.json

@@ -1 +1 @@
-{"name":"@tally-local/shared","version":"1.0.0","private":true,"license":"MIT","type":"module","exports":{".":"./src/index.ts"},"scripts":{"build":"tsup src/index.ts --format esm --dts","typecheck":"tsc --noEmit"},"dependencies":{"zod":"4.5.4"}}
+{"name":"@tally-local/shared","version":"1.0.0","private":true,"license":"MIT","type":"module","exports":{".":"./src/index.ts"},"scripts":{"build":"tsup src/index.ts --format esm --dts","typecheck":"tsc --noEmit"},"dependencies":{"zod":"4.6.6"}}