Monthly dependency review: 2026-11

Automated discovery only. No dependency files were changed or installed by this report.
Security fixes use Dependabot alerts/PRs immediately; do not wait for this review.

Major application dependencies

• msw: 2.15.0 → 3.0.3

Separate toolchain PRs

• pnpm: 12.10.1 → 12.16.1
• Node.js (Docker; latest LTS): 24.21.0 → 26.13.0
• TypeScript: 7.0.2 (current)
• @types/node: 24.19.2 → 26.6.6

Create one PR per tool when an update is appropriate; a listed version is not a requirement to upgrade.
Coordinate pnpm's packageManager pin, Docker RUN pin, lockfile environment document and docs.
Coordinate Node's Docker images/digests, Netlify pin, supported engines, CI matrix and deployment fixtures/docs.
Keep TypeScript consistent in all workspace manifests and check Next.js/compiler compatibility.

Review before merging

• Read upstream release notes, breaking changes, Node/peer requirements and migration instructions.
• Let ordinary new releases age 3–7 days; urgent applicable security fixes are exempt.
• Keep each major migration separate; defer or close candidates that do not benefit this project.
• Run format:check, typecheck, lint, knip, test, test:deployment, test:e2e, build and test:production.
• Review advisories for actual exposure; passing CI alone does not establish security applicability.