chore(deps): update 18 dependencies while preserving Zod contracts

.github/dependabot.yml

@@ -21,6 +21,10 @@ updates:
     open-pull-requests-limit: 5
     groups:
       patch-and-minor:
+        # Zod upgrades can change the public App Kit validation error contract.
+        # Review them independently from routine dependency updates.
+        exclude-patterns:
+          - "zod"
         update-types:
           - "patch"
           - "minor"

apps/api/package.json

@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@deft/app-kit": "workspace:*",
-    "@anthropic-ai/sdk": "^0.117.1",
+    "@anthropic-ai/sdk": "^0.126.0",
     "@deft/db": "workspace:*",
     "@deft/mcp": "workspace:*",
     "@deft/shared": "workspace:*",
@@ -25,22 +25,22 @@
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
     "fflate": "0.8.3",
-    "hono": "^4.13.2",
-    "hono-rate-limiter": "^0.5.3",
+    "hono": "^4.13.8",
+    "hono-rate-limiter": "^0.5.4",
     "jsonwebtoken": "^9.0.3",
-    "node-ical": "^0.27.1",
+    "node-ical": "^0.27.2",
     "pg": "^8.23.0",
     "read-excel-file": "9.3.10",
     "socket.io": "^4.8.3",
-    "tsx": "^4.23.12",
+    "tsx": "^4.23.13",
     "web-push": "^3.6.7",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/bcryptjs": "^3.0.0",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^26.2.0",
-    "@types/pg": "^8.21.0",
+    "@types/node": "^26.6.1",
+    "@types/pg": "^8.23.1",
     "@types/web-push": "^3.6.4"
   }
 }

apps/web/package.json

@@ -44,13 +44,13 @@
     "d3-force": "^3.0.0",
     "d3-selection": "^3.0.0",
     "d3-zoom": "^3.0.0",
-    "dompurify": "^3.4.13",
+    "dompurify": "^3.4.15",
     "lowlight": "^3.3.0",
-    "lucide-react": "^1.31.0",
-    "next": "16.3.3",
-    "postcss": "^8.5.26",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
+    "lucide-react": "^1.46.0",
+    "next": "16.3.5",
+    "postcss": "^8.5.28",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "react-grid-layout": "^1.5.4",
     "react-markdown": "^10.1.0",
     "react-resizable": "^4.0.2",
@@ -66,16 +66,16 @@
   "devDependencies": {
     "@types/d3-drag": "^3.0.7",
     "@types/d3-force": "^3.0.10",
-    "@types/d3-selection": "^3.0.11",
+    "@types/d3-selection": "^3.0.12",
     "@types/d3-zoom": "^3.0.8",
     "@types/dompurify": "^3.2.0",
-    "@types/node": "^26.2.0",
-    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
+    "@types/node": "^26.6.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "@types/react-grid-layout": "^1.3.6",
     "@types/simple-peer": "^9.11.9",
     "eslint": "^9.39.5",
-    "eslint-config-next": "16.3.3",
+    "eslint-config-next": "16.3.5",
     "typescript": "^6.0.3"
   }
 }

docs/superpowers/plans/2026-09-23-dependency-compatibility-followups.md

@@ -0,0 +1,40 @@
+# Dependency compatibility follow-ups
+
+Reviewed against GitHub master `9e6fca0a2ea400822bcb3c8380415025a1382d1c` on 2026-09-23.
+
+## Zod 4.6.5: separate from PR #335
+
+The original 19-update batch changes Zod 4.4.3 to 4.6.5. The focused App Kit
+test `preserves direct v0 rejection issues instead of wrapping them in a v1
+union error` fails: verification now adds a custom issue at
+`manifest.navigation[0].module_id` alongside the existing `too_small` and
+`unrecognized_keys` issues. The protocol explicitly freezes rejection issue
+shapes. Do not weaken that assertion as part of routine maintenance.
+
+Keep the direct API, shared and App Kit Zod versions at their master baseline
+and exclude Zod from Dependabot's patch/minor group so it receives separate
+review. A workspace override also holds transitive MCP and lint dependencies
+at 4.4.3; remove it as part of the reviewed compatibility update. This is not a
+security exception: the dependency audit reports no known vulnerabilities.
+
+Re-entry criteria:
+
+1. Reproduce with `pnpm --filter @deft/app-kit exec tsx --test
+   --test-name-pattern 'preserves direct v0 rejection' test/app-kit.test.ts`.
+2. Compare old/new diagnostics for all frozen v0/v1/v2 malformed manifests and
+   packages, including unknown keys, missing modules, duplicate identities and
+   invalid navigation. Confirm accepted/rejected inputs remain unchanged.
+3. Preserve the existing public error contract with a reviewed compatibility
+   adapter, or explicitly version any intended contract change. Do not filter
+   away validation errors or alter authority checks merely to pass the test.
+4. Pass App Kit contracts, API/shared tests, workspace typecheck, web lint,
+   build, audit and required CI before merging the independent update.
+
+## ESLint 10: PR #322 remains draft
+
+The existing React plugin crashes loading `react/display-name` with
+`contextOrFilename.getFilename is not a function`. Keep the update deferred
+until the Next/React plugin and configuration stack supports ESLint 10.
+Upgrade compatible pieces together, retaining enabled rules, and require
+full web lint, typecheck, build and CI. See the failing run:
+https://github.com/Maneek21/Deft/actions/runs/35465294161.

package.json

@@ -85,8 +85,8 @@
     "node": ">=22.13.0"
   },
   "devDependencies": {
-    "playwright": "^1.62.1",
-    "tsx": "^4.23.12",
+    "playwright": "^1.63.0",
+    "tsx": "^4.23.13",
     "typescript": "^6.0.3"
   }
 }

packages/app-kit/package.json

@@ -28,8 +28,8 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
-    "tsx": "^4.23.12",
+    "@types/node": "^26.6.1",
+    "tsx": "^4.23.13",
     "typescript": "^6.0.3"
   },
   "publishConfig": {

packages/db/package.json

@@ -29,8 +29,8 @@
   },
   "devDependencies": {
     "@types/bcryptjs": "^3.0.0",
-    "@types/pg": "^8.21.0",
+    "@types/pg": "^8.23.1",
     "drizzle-kit": "^0.31.10",
-    "tsx": "^4.23.12"
+    "tsx": "^4.23.13"
   }
 }

packages/mcp/package.json

@@ -10,7 +10,7 @@
     "@modelcontextprotocol/client": "2.0.0"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.6.1",
     "typescript": "^6.0.3"
   }
 }

packages/shared/package.json

@@ -19,8 +19,8 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
-    "tsx": "^4.23.12",
+    "@types/node": "^26.6.1",
+    "tsx": "^4.23.13",
     "typescript": "^6.0.3"
   }
 }