Consolidate open PRs: dependency updates and CI action bumps

[Copilot]

Consolidates 12 open PRs (dependency bumps, CI action upgrades) into a single merge. Supersedes 3 additional Snyk PRs already covered by broader updates. Skips 6 PRs that are stale, have peer dep conflicts, or are large infrastructure additions requiring individual review.

CI Action Bumps (#21, #22, #23)

• actions/checkout v4 → v5
• actions/github-script v7 → v8
• SonarSource/sonarcloud-github-action pinned to latest commit

Production Dependencies (#59, #47)

• vue 3.5.22 → 3.5.27
• element-plus 2.11.4 → 2.13.2
• @element-plus/icons-vue 2.3.1 → 2.3.2
• vue-router 4.5.1 → 4.6.3

Dev Dependencies (#27, #33, #26)

• vite 6.0.6 → 6.4.3 (6.4.1 has server.fs.deny bypass — patched in 6.4.3)
• stylelint 16.12.0 → 16.25.0
• stylelint-config-standard-scss 14.0.0 → 16.0.0
• stylelint-config-tailwindcss 0.0.7 → 1.0.0

Post-merge cleanup

• Updated post-merge-cleanup.yml PR numbers and branch refs to match this consolidation

Superseded PRs (no action needed)

• [Snyk] Upgrade vue from 3.5.22 to 3.5.23 #58, [Snyk] Upgrade element-plus from 2.11.4 to 2.11.5 #49, [Snyk] Upgrade @element-plus/icons-vue from 2.3.1 to 2.3.2 #48 — individual Snyk bumps already covered by deps(deps): bump the production-dependencies group across 1 directory with 3 updates #59

Skipped PRs

PR	Reason
#61	@typescript-eslint/eslint-plugin 8.56.1 has peer dep conflict with @vue/eslint-config-typescript
#40	Author-marked outdated, needs rebase
#57, #10	Trivial/stale
#28, #30, #36	Large infra additions (Docker, Pulumi, devcontainer) — review individually

[sourcery-ai]

Reviewer's Guide

Consolidates multiple Dependabot/Snyk and CI-related PRs by bumping core frontend dependencies (Vue, Element Plus, vue-router), dev tooling (Vite, Stylelint configs), and GitHub Actions (checkout, github-script, SonarCloud), while updating the post-merge cleanup workflow to target the new consolidated PRs and branches and refreshing generated auto-import typings.

Sequence diagram for consolidated post-merge cleanup workflow

sequenceDiagram
  actor Developer
  participant GitHub
  participant PostMergeCleanupWorkflow
  participant actions_checkout
  participant actions_github_script

  Developer->>GitHub: Merge consolidation_PR
  GitHub->>PostMergeCleanupWorkflow: Trigger post-merge-cleanup.yml
  PostMergeCleanupWorkflow->>actions_checkout: actions/checkout@v5
  actions_checkout-->>PostMergeCleanupWorkflow: Repository checked out

  PostMergeCleanupWorkflow->>actions_github_script: check_consolidation (actions/github-script@v8)
  actions_github_script-->>PostMergeCleanupWorkflow: is_consolidation == 'true'

  alt [is_consolidation == 'true']
    PostMergeCleanupWorkflow->>actions_github_script: Close consolidated PRs
    actions_github_script->>GitHub: github.rest.issues.createComment (prsToClose)
    actions_github_script->>GitHub: github.rest.pulls.update (state = closed)

    PostMergeCleanupWorkflow->>actions_github_script: Delete consolidated branches
    actions_github_script->>GitHub: github.rest.git.deleteRef (branchesToDelete)
  else [is_consolidation != 'true']
    PostMergeCleanupWorkflow-->>GitHub: No cleanup performed
  end

Loading

File-Level Changes

Change	Details	Files
Update CI workflows to latest GitHub Action versions for checkout, github-script, and SonarCloud scanning.	Bump actions/checkout from v4 to v5 across all workflows that perform repository checkouts. Bump actions/github-script from v7 to v8 wherever custom scripting is used in workflows, including cleanup and reporting steps. Update SonarSource/sonarcloud-github-action to a newer pinned commit hash in sonarcloud.yml.	.github/workflows/post-merge-cleanup.yml .github/workflows/azure-staging-cleanup.yml .github/workflows/azure-static-web-apps-thankful-mushroom-08ecc5d1e.yml .github/workflows/ci.yml .github/workflows/lockfile-sync.yml .github/workflows/sonarcloud.yml
Revise post-merge cleanup workflow to close and delete branches for the newly consolidated dependency-update PRs.	Replace the list of PR numbers to close with the IDs of the consolidated dependency and CI action bump PRs. Replace the list of branches to delete with the Dependabot/Snyk branches corresponding to those consolidated PRs while keeping the cleanup logic intact.	.github/workflows/post-merge-cleanup.yml
Upgrade production and development npm dependencies to current versions and refresh lockfile.	Bump Vue, Element Plus, @element-plus/icons-vue, and vue-router to newer minor/patch releases in package.json. Update dev tooling including stylelint, stylelint-config-standard-scss, stylelint-config-tailwindcss, and Vite to newer major/minor versions, ensuring Vite is patched beyond the server.fs.deny bypass advisory. Regenerate package-lock.json to reflect the new dependency tree and resolved versions.	package.json package-lock.json
Refresh auto-import TypeScript declarations to include new VueUse utilities available after dependency updates.	Extend auto-imports.d.ts with additional VueUse composables and helpers such as createReusableTemplate, createTemplatePromise, injectLocal, provideLocal, new array utilities, clipboard helpers, performance and parent element utilities, and extra watch helpers. Keep the structure and existing declarations intact while appending new lines in the generated module declaration for 'vue'.	auto-imports.d.ts

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.