chore(deps): update codebase dependencies

[Marve10s]

Codebase Dependency Updates

This PR updates workspace dependencies used by the repository codebase (package.json + bun.lock).

• Update mode: patch-minor
• Scope: root + all Bun workspaces (--recursive)

Build verification

✅ Safe

• bun run --cwd packages/types build and bun run --cwd packages/template-generator build completed successfully.

⚠️ Needs attention

• None. bun run --cwd packages/types build and bun run --cwd packages/template-generator build completed successfully.

Lint verification

✅ Safe

• bun run lint completed successfully.

⚠️ Needs attention

• None. bun run lint completed successfully.

Test verification

✅ Safe

• bun run test completed successfully.

⚠️ Needs attention

• None. bun run test completed successfully.

---

Automated by codebase-deps.yaml

Confidence Score: 4/5

The PR appears safe to merge after correcting the non-blocking internal dependency-range downgrades.

The external dependency updates have no established build or runtime regression, but the generated manifests undo synchronized 2.6.3 dependency floors for two packages and should retain the matching release versions.

Files Needing Attention: packages/create-bfs/package.json and packages/template-generator/package.json

Important Files Changed

Filename	Overview
packages/create-bfs/package.json	The create-better-fullstack dependency floor is incorrectly lowered from the matching 2.6.3 release to 2.6.2.
packages/template-generator/package.json	The shared types dependency floor is similarly lowered from 2.6.3 to 2.6.2.
apps/web/package.json	Applies compatible patch and minor updates to web runtime and development dependencies with no concrete regression identified.
apps/cli/package.json	Updates the CLI's pinned Zod dependency consistently with the shared types package.
packages/types/package.json	Updates Zod to 4.5.2; existing schema usage and reported verification reveal no concrete failure.
package.json	Updates root development tooling within existing compatible version ranges.
bun.lock	Regenerates resolutions for the manifest updates and records the same internal dependency-range regressions.

_{Reviews (1): Last reviewed commit: "chore(deps): update codebase dependencie..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Summary by CodeRabbit

• Chores
  • Updated internal libraries and development tooling to newer compatible versions.
  • Refreshed web application dependencies, including routing, localization, analytics, validation, and CSV support.
  • Aligned project package versions for improved consistency across the codebase.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
better-fullstack-web	Ready	Preview	Aug 31, 2026 5:34pm

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T17:33:48.379219Z	e46a47d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Workspace dependency floors regress

This dependency update lowers create-better-fullstack from ^2.6.3 to ^2.6.2 and similarly lowers @better-fullstack/types in the template generator, so publishing the 2.6.3 packages permits consumers to resolve older internal implementations that omit synchronized 2.6.3 changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 313cfcea-f9a1-4465-8156-3776cfa4ac0b

📥 Commits

Reviewing files that changed from the base of the PR and between 1da5a40 and e46a47d.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• apps/cli/package.json
• apps/web/package.json
• package.json
• packages/create-bfs/package.json
• packages/template-generator/package.json
• packages/types/package.json

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates dependency versions in application, package, and repository configuration files. It upgrades several external dependencies and changes two internal package ranges from version 2.6.3 to 2.6.2.

Changes

Dependency updates

Layer / File(s)	Summary
Application and package dependencies apps/cli/package.json, apps/web/package.json, packages/types/package.json	Updates zod, TanStack packages, papaparse, posthog-js, @inlang/paraglide-js, and @types/react-dom.
Repository tooling dependencies package.json	Updates lefthook, oxlint, and turbo development dependency ranges.
Internal package dependency alignment packages/create-bfs/package.json, packages/template-generator/package.json	Changes internal dependency ranges from ^2.6.3 to ^2.6.2.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to e46a4

The dependency updates pass the stated build, lint, and test checks, and no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency updates made across the codebase.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (6 skipped: 6 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch deps/codebase-updates

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e46a47dddd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep the alias dependency on the matching CLI release

When an existing project upgrades create-bfs to 2.6.3, its lockfile may legally retain create-better-fullstack 2.6.2 because the downgraded range still accepts it. Since create-bfs only forwards to create-better-fullstack/cli, that leaves users running the previous implementation and, in particular, makes the new 2.6.3 create-bfs install command unavailable. Restore the dependency floor to ^2.6.3, as set by the release bump.

Useful? React with 👍 / 👎.