chore(deps): pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token	action	pin	v3 → v3.2.0
node (source)	engines	pin	>=20.19.0 → v26.5.0
node (source)	engines	pin	>=20.12.0 → v26.5.0
pnpm (source)	engines	pin	>=8.0.0 → 11.17.0
react (source)	peerDependencies	pin	^19.1.0 → 19.2.8
react (source)	peerDependencies	pin	>=19.0.0 → 19.2.8
react-dom (source)	peerDependencies	pin	^19.1.0 → 19.2.8
sonner (source)	peerDependencies	pin	^2.0.7 → 2.0.7

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 47c4464

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates Node/pnpm runtime requirements across packages/apps and tightens dependency constraints, plus refreshes a GitHub Action pin for releases.

Changes:

• Pin engines for Node and pnpm to specific versions across multiple package.json files
• Pin some peerDependencies (React/ReactDOM/Sonner) to exact versions in UI-related packages
• Update actions/create-github-app-token to a newer pinned commit in the release workflow

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/url-state-provider/package.json	Pins Node/pnpm engine versions
packages/ui-components/package.json	Pins Node/pnpm engines and tightens peer dependency versions
packages/template/package.json	Pins Node/pnpm engine versions
packages/oauth/package.json	Pins Node/pnpm engine versions
packages/messages-provider/package.json	Pins Node/pnpm engine versions
packages/greenhouse-auth-provider/package.json	Pins Node/pnpm engines and tightens React peer dependency
packages/communicator/package.json	Pins Node/pnpm engine versions
apps/template/package.json	Pins Node/pnpm engine versions
apps/heureka/package.json	Pins Node/pnpm engine versions
apps/example/package.json	Pins Node/pnpm engine versions
apps/carbon/package.json	Pins Node/pnpm engine versions
.github/workflows/release.yaml	Updates pinned create-github-app-token action digest