chore(deps): upgrade dependencies (#2346)

* chore(deps): upgrade dependencies

Bump dependencies across the workspace and catalog (eslint, undici,
AWS SDK, Sentry, Tiptap, Storybook, Vite, Vitest, and others).
Restore `catalog:` specifiers that the upgrade had inlined to pinned
versions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: fix format

* fix(backend): repair tests and types broken by dependency upgrade

- Storage tests: drain the S3 GetObject response body and destroy the
  S3 clients so leaked/aborted keep-alive sockets no longer surface as
  an uncaught "aborted" (ECONNRESET) error that failed the unit run.
- Stripe: bump the pinned apiVersion to 2026-06-24.dahlia to match the
  stripe@22.3.0 SDK types.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deps): pin playwright and vitest eslint plugin to avoid regressions

Two patch bumps from the upgrade broke CI, so pin each to the last
known-good version (still used on main):

- @playwright/test 1.61.1 regressed its ESM loader: it forces the
  "commonjs" format for require-context loads while the transform still
  emits ESM, so loading the backend TS source from the e2e suite throws
  "Cannot use import statement outside a module". Pin to 1.61.0.
- @vitest/eslint-plugin 1.6.21 regressed vitest/valid-expect, flagging
  the standard `expect.any()` asymmetric matcher as an unknown modifier
  across the e2e tests. Pin to 1.6.20.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gregberge

apps/backend/package.json

@@ -33,14 +33,14 @@
     "@argos/schemas": "workspace:*",
     "@argos/util": "workspace:*",
     "@as-integrations/express5": "^1.1.2",
-    "@aws-sdk/client-dynamodb": "^3.1073.0",
-    "@aws-sdk/client-s3": "^3.1073.0",
-    "@aws-sdk/lib-dynamodb": "^3.1073.0",
+    "@aws-sdk/client-dynamodb": "^3.1081.0",
+    "@aws-sdk/client-s3": "^3.1081.0",
+    "@aws-sdk/lib-dynamodb": "^3.1081.0",
     "@aws-sdk/lib-storage": "^3.1073.0",
-    "@aws-sdk/s3-presigned-post": "^3.1073.0",
-    "@aws-sdk/s3-request-presigner": "^3.1073.0",
+    "@aws-sdk/s3-presigned-post": "^3.1081.0",
+    "@aws-sdk/s3-request-presigner": "^3.1081.0",
     "@gitbeaker/rest": "^43.8.0",
-    "@graphql-tools/schema": "^10.0.33",
+    "@graphql-tools/schema": "^10.0.35",
     "@octokit/auth-app": "^8.2.0",
     "@octokit/core": "^7.0.6",
     "@octokit/openapi-types": "^27.0.0",
@@ -49,17 +49,17 @@
     "@octokit/rest": "^22.0.1",
     "@octokit/webhooks": "^14.2.0",
     "@octokit/webhooks-types": "^7.6.1",
-    "@sentry/node": "^10.59.0",
+    "@sentry/node": "^10.64.0",
     "@slack/bolt": "^4.7.3",
-    "@tiptap/core": "^3.27.1",
-    "@tiptap/extension-mention": "^3.27.1",
-    "@tiptap/html": "^3.27.1",
-    "@tiptap/pm": "^3.27.1",
-    "@tiptap/starter-kit": "^3.27.1",
+    "@tiptap/core": "^3.27.3",
+    "@tiptap/extension-mention": "^3.27.3",
+    "@tiptap/html": "^3.27.3",
+    "@tiptap/pm": "^3.27.3",
+    "@tiptap/starter-kit": "^3.27.3",
     "ajv": "^8.20.0",
     "amqplib": "^2.0.1",
     "auth-header": "^1.0.0",
-    "axios": "^1.18.0",
+    "axios": "^1.18.1",
     "clsx": "^2.1.1",
     "convict": "^6.2.5",
     "cookies": "^0.9.1",
@@ -69,24 +69,24 @@
     "dotenv": "^17.4.2",
     "express": "catalog:",
     "express-rate-limit": "^8.5.2",
-    "google-auth-library": "^10.7.0",
-    "graphql": "^16.14.2",
+    "google-auth-library": "^10.9.0",
+    "graphql": "16.14.2",
     "graphql-scalars": "^1.25.0",
     "graphql-tag": "^2.12.7",
     "graphql-ws": "^6.0.8",
     "happy-dom": "^20.10.6",
     "helmet": "^8.2.0",
     "jsonwebtoken": "^9.0.3",
-    "knex": "^3.2.10",
+    "knex": "^3.3.0",
     "lodash-es": "catalog:",
-    "marked": "^15.0.0",
+    "marked": "^18.0.5",
     "mime": "^4.1.0",
     "minimatch": "catalog:",
     "moment": "^2.30.1",
-    "node-cron": "^4.4.1",
+    "node-cron": "^4.6.0",
     "objection": "^3.1.5",
     "odiff-bin": "^4.3.8",
-    "ora": "^9.4.0",
+    "ora": "^9.4.1",
     "p-memoize": "^8.0.0",
     "p-retry": "^8.0.0",
     "p-timeout": "^7.0.1",
@@ -96,17 +96,17 @@
     "pino-http": "^11.0.0",
     "rate-limit-redis": "^5.0.0",
     "react": "catalog:",
-    "react-email": "^6.6.3",
-    "redis": "^6.0.0",
-    "resend": "^6.14.0",
+    "react-email": "^6.6.8",
+    "redis": "^6.1.0",
+    "resend": "^6.17.1",
     "samlify": "^2.13.1",
     "semver": "^7.8.5",
-    "sharp": "^0.35.2",
+    "sharp": "^0.35.3",
     "sqids": "^0.3.0",
-    "stripe": "^22.2.2",
+    "stripe": "^22.3.0",
     "tmp": "^0.2.7",
     "undici": "catalog:",
-    "ws": "^8.21.0",
+    "ws": "^8.20.1",
     "yaml": "^2.9.0",
     "zod": "catalog:",
     "zod-openapi": "^6.0.0"
@@ -133,7 +133,7 @@
     "eslint": "catalog:",
     "factory-girl-ts": "^2.3.1",
     "moment": "^2.30.1",
-    "msw": "^2.14.6",
+    "msw": "^2.14.7",
     "pino-pretty": "^13.1.3",
     "supertest": "^7.2.2"
   },

apps/backend/src/api/handlers/createDeployment.ts

@@ -202,8 +202,7 @@ async function writeDeploymentFiles(
 
           requests =
             (result.UnprocessedItems?.[tableName] as
-              | typeof requests
-              | undefined) ?? [];
+              typeof requests | undefined) ?? [];
           if (requests.length > 0) {
             throw new Error(
               `DynamoDB returned ${requests.length} unprocessed deployment files`,

apps/backend/src/api/handlers/finalizeDeployment.ts

@@ -63,8 +63,7 @@ async function getDeploymentFileHashes(
       );
     }
     exclusiveStartKey = result.LastEvaluatedKey as
-      | Record<string, unknown>
-      | undefined;
+      Record<string, unknown> | undefined;
   } while (exclusiveStartKey);
 
   return items;
@@ -117,8 +116,7 @@ async function registerFileHashes(
 
           requests =
             (result.UnprocessedItems?.[tableName] as
-              | typeof requests
-              | undefined) ?? [];
+              typeof requests | undefined) ?? [];
           if (requests.length > 0) {
             throw new Error(
               `DynamoDB returned ${requests.length} unprocessed file hashes`,

apps/backend/src/build/baselineEligibility.ts

@@ -9,11 +9,7 @@ import type { Build } from "@/database/models";
  * against, so they cannot be evaluated for a build in isolation.
  */
 export type BuildBaselineIneligibilityReason =
-  | "build-incomplete"
-  | "tests-failed"
-  | "subset"
-  | "rejected"
-  | "not-approved";
+  "build-incomplete" | "tests-failed" | "subset" | "rejected" | "not-approved";
 
 export type BuildBaselineEligibility = {
   eligible: boolean;

apps/backend/src/database/models/Account.ts

@@ -26,8 +26,7 @@ export type AccountAvatar = {
 };
 
 export type AccountSubscriptionStatus =
-  | Subscription["status"]
-  | "trial_expired";
+  Subscription["status"] | "trial_expired";
 
 type AccountSubscriptionManager = {
   getActiveSubscription(): Promise<Subscription | null>;

apps/backend/src/database/models/Project.ts

@@ -23,11 +23,7 @@ import { TeamUser } from "./TeamUser";
 import type { User } from "./User";
 
 type ProjectPermission =
-  | "admin"
-  | "review"
-  | "review_dismiss"
-  | "view_settings"
-  | "view";
+  "admin" | "review" | "review_dismiss" | "view_settings" | "view";
 export type DeploymentAuth = "public" | "domain-private" | "private";
 
 /**

apps/backend/src/database/services/account.ts

@@ -302,8 +302,7 @@ async function getOrCreateUserAccountFromThirdParty<
   getName: (model: TModel) => string | null;
   getPotentialEmails: (model: TModel) => string[];
   thirdPartyKey:
-    | { user: "gitlabUserId" | "googleUserId" }
-    | { account: "githubAccountId" };
+    { user: "gitlabUserId" | "googleUserId" } | { account: "githubAccountId" };
   errorCodes: {
     alreadyAttachedToArgosAccount: ErrorCode;
     alreadyAttachedToThirdPartyAccount: ErrorCode;

apps/backend/src/graphql/definitions/Comment.ts

@@ -405,9 +405,7 @@ export const resolvers: IResolvers = {
     // `side` differs nominally (model string-union vs generated enum), so cast.
     anchor: (comment) =>
       (comment.anchor ?? null) as
-        | ICommentPointAnchor
-        | ICommentLinesAnchor
-        | null,
+        ICommentPointAnchor | ICommentLinesAnchor | null,
     threadSubscribed: async (comment, _args, ctx) => {
       if (!ctx.auth) {
         return false;

apps/backend/src/notification/workflow-types.ts

@@ -18,12 +18,7 @@ type HandlerContext = {
  * notifications they want to receive.
  */
 export type NotificationCategory =
-  | "account"
-  | "security"
-  | "review"
-  | "billing"
-  | "project"
-  | "integration";
+  "account" | "security" | "review" | "billing" | "project" | "integration";
 
 export type NotificationHandler<TType extends string = string, TData = any> = {
   type: TType;

apps/backend/src/storage/download.test.ts

@@ -4,7 +4,7 @@ import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { S3Client } from "@aws-sdk/client-s3";
 import { dirSync } from "tmp";
-import { beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
 
 import config from "@/config";
 
@@ -33,6 +33,10 @@ describe("#download", () => {
     tmpDirectory = dirSync().name;
   });
 
+  afterAll(() => {
+    s3.destroy();
+  });
+
   it("should download a file from S3", async () => {
     const outputPath = join(tmpDirectory, "hello.txt");
     const result = await get({