chore: bump deps

[adibarra]

Note

Low Risk
Changes are version bumps and test-only setup/assertions; runtime app behavior is unchanged aside from routine patch/minor dependency updates.

Overview
Dependency maintenance across the repo: root pnpm (11.9.0 → 11.17.0), vite, oxfmt, and oxlint; app Next, React, Radix UI, Tailwind, Cypress, adm-zip (0.5.x → 0.6.0), and related packages; aligned tsx bumps in db and mcp.

Test infrastructure adds a Vitest setupFiles hook that replaces Node’s experimental localStorage with an in-memory Storage implementation so unit tests don’t hit warning getters.

chunk-load-recovery tests stub location.reload via a prototype-preserving Location copy, assert reload runs only once on repeated chunk errors, restore window.location in afterAll, and verify idempotent installs by spying on addEventListener after vi.resetModules() (no production changes to recovery logic).

^{Reviewed by Cursor Bugbot for commit 079efc5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
inferencemax-app	Ready	Preview, Comment	Jul 27, 2026 2:41am

[Copilot]

Pull request overview

Routine dependency bump PR across the monorepo, with updated pnpm security overrides and a small unit-test/script adjustment to keep Vitest working under newer Node/jsdom behavior.

Changes:

• Bumped a broad set of dependencies (pnpm, oxlint/oxfmt, vite; app deps like Next/React/Radix/Tailwind/Cypress/PostHog; db/mcp tooling like tsx and adm-zip).
• Updated pnpm-workspace.yaml security overrides for multiple advisories.
• Adjusted app unit-test scripts to set NODE_OPTIONS=--localstorage-file=... and updated chunk-load-recovery unit tests to assert reload deduplication behavior.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Updated pnpm security override pins (and related advisory handling).
packages/mcp/package.json	Bumped tsx dev dependency.
packages/db/package.json	Bumped adm-zip and tsx dev dependencies.
packages/app/src/lib/chunk-load-recovery.test.ts	Updated assertions to validate reload deduping rather than sessionStorage.setItem spying.
packages/app/package.json	Added NODE_OPTIONS=--localstorage-file=... to Vitest unit scripts; bumped app dependencies.
package.json	Bumped root dev tooling versions and updated packageManager pnpm version.

Comments suppressed due to low confidence (1)

packages/app/src/lib/chunk-load-recovery.test.ts:69

• This test now verifies idempotency via reload call count (duplicate listeners would cause multiple reload attempts), not duplicate gate writes. Rename the test description to match what’s asserted.

  it('is idempotent: repeated installs do not duplicate the gate write', () => {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

pnpm-workspace.yaml:22

• These comments say “patched 3.15.x line”, but the actual override below enforces the broader semver range >=3.15.0 <4.0.0. To avoid confusion during future security audits, align the wording with what the override actually does.

# - gray-matter calls js-yaml's safeLoad/safeDump APIs, which 4.x removes. Keep js-yaml
#   on the patched 3.15.x line; the remaining build-time advisory applies only to trusted
#   frontmatter input and is ignored below.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 3eb7fe6. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.