[goetchstone]

Why

This replaces Dependabot's #127 (prod-deps), #125 (dev-deps), and #129 (dev-deps-security). Their groups overlap in package-lock.json, and each was blocked by something in it. After this PR, npm audit reports 0 vulnerabilities, production and dev.

What's in it

Production: @base-ui/react 1.9.0, @react-pdf/renderer 4.9.0, @rgrove/parse-xml 5.0.0 (ESM-only, API unchanged), @tanstack/react-query 5.104.3, @trpc/* 11.19.0, lucide-react 1.57.0, pino 10.4.0, react/react-dom 19.3.1 (what Next 16.4 ships), tailwind-merge 3.7.0, stripe 22.6.2.

Dev: Vitest and coverage 5.0.5 (fixes the @vitest/mocker advisory), dotenv 18.0.8, eslint 10.12.0, shadcn 4.22.1 (moves its nested Zod 3 to Zod 4, which clears a high advisory), Tailwind 4.3.3, tsx 4.23.15. Override floors raised for shadcn's dev-only MCP tree: undici ≥7.30.1, fast-uri ≥3.1.9, ip-address ≥10.7.4.

Removed: @vitejs/plugin-react. Nothing imports it, the Vitest config has no plugins, and its optional Babel 8 peer chain made the dev update fail with ERESOLVE.

Deliberately not taken

• Stripe 23: it moves to the endive API, which is the kind of release that carries breaking changes. Instead: SDK 22.6.2, with the pinned apiVersion bumped within dahlia (2026-06-24 → 2026-08-26). Stripe only makes breaking changes when the release name changes. This was build(deps): bump the prod-deps group across 1 directory with 17 updates #127's type-check failure. I couldn't test against Stripe; there are no test keys here.
• TypeScript 7: npm run lint fails with "typescript-eslint does not support TS 7.0" (support is tracked for 7.1). Staying on 6.0.3.
• @types/node 26: moved to ^24 instead, so the types match the Node 24 runtime and don't offer APIs that would crash in production.

Dependabot (.github/dependabot.yml)

• Stripe is excluded from the prod-deps group. Each Stripe minor retypes apiVersion, which failed type-check for the whole group and held 16 updates for two weeks, a zod security fix among them. Stripe now gets its own PR.
• Majors ignored for stripe, typescript, and @types/node, each with its reason in a comment.

Found while doing this

npm run lint has been crashing on main (eslint-plugin-react vs ESLint 10). With the updated stack it runs and reports 20 errors in existing code. Lint isn't in CI. That's recorded in CLAUDE.md Known Issues and left for a separate change.

Verification (Node 24.22.1, real images)

• tsc, vitest (124/124, on Vitest 5), and npm audit (0 total) all pass.
• production and migrator images against throwaway Postgres + Mailpit:
  • schema push, seed, and all blog seeds (runs prisma.config.ts under dotenv 18)
  • all public pages and all 19 dashboard pages (logged in as admin)
  • the three PDFs (react-pdf 4.9) and DMARC live DNS
  • lead submit: visitor and owner emails delivered; a malformed address rejected
• In a real browser on the production image: the home page, login through the form, the dashboard, and the new-invoice form (Add line works); the Base UI account menu opens. No console errors.

DECISIONS entry (Stripe), two LESSONS entries, and CLAUDE.md Known Issues are updated.

🤖 Generated with Claude Code