Validate dependency upgrades and remove cleared toolchain holds

.github/dependabot.yml

@@ -4,20 +4,15 @@ version: 2
 # Dart package changelog. Keep the CI actions current without mixing automated
 # dependency releases into those workflows.
 #
-# TypeScript majors are held back in both npm ecosystems below, and the two halves
-# are held for different reasons.
+# The documentation toolchain still requires TypeScript 6. Server builds use
+# TypeScript 7 with tsdown 0.23.4; its declaration generator supports that compiler.
 #
 # `/web` is genuinely blocked. `typedoc` peers at `<=6.0.x` and 0.28.20 is its
 # latest stable; the only newer publishes are 1.0.0-dev prereleases, and
 # `typedoc-plugin-markdown` -- which is what actually generates the TypeScript
 # reference -- peers at `typedoc: 0.28.x` exactly, so it could not follow even if
 # the prerelease were acceptable in a docs build.
 #
-# `/server` is also blocked: TypeScript 7.0.2 lacks the classic compiler API
-# used by rolldown-plugin-dts in tsdown 0.23.2. Its native declaration generator
-# requires TypeScript 7.1+, currently prerelease. Keep the stable 6.0.3 compiler
-# until both declaration generation and the documentation pipeline support 7.
-#
 # Routine minor and patch updates are grouped to keep maintenance cheap. Major
 # updates stay in focused pull requests so an incompatible upgrade cannot block
 # unrelated maintenance or obscure the cause of a failing check.
@@ -36,10 +31,6 @@ updates:
     directory: /server
     schedule:
       interval: monthly
-    # See the header: nothing blocks 7 here; held to match `/web`.
-    ignore:
-      - dependency-name: typescript
-        update-types: ["version-update:semver-major"]
     groups:
       # The Workers Vitest plugin relies on Vitest internals and peers on its
       # major, and the coverage provider is versioned in lockstep with Vitest,

.github/workflows/checks.yml

@@ -104,7 +104,7 @@ jobs:
           cache: pnpm
           cache-dependency-path: server/pnpm-lock.yaml
 
-      - uses: actions/setup-java@v6.0.1
+      - uses: actions/setup-java@v6.1.0
         if: needs.scope.outputs.full == 'true'
         with:
           distribution: temurin
@@ -239,7 +239,7 @@ jobs:
           channel: stable
           cache: true
 
-      - uses: actions/setup-java@v6.0.1
+      - uses: actions/setup-java@v6.1.0
         if: needs.scope.outputs.full == 'true' && matrix.target == 'android'
         with:
           distribution: temurin

.github/workflows/publish-dart.yml

@@ -147,7 +147,7 @@ jobs:
       # token does -- so the listener would stay idle while this step reported
       # success, which is the failure this comment exists to stop someone
       # reintroducing.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@v3.3.0
         id: app-token
         if: steps.published.outputs.skip == 'false'
         with:

.github/workflows/publish-eigen-api.yml

@@ -110,7 +110,7 @@ jobs:
       # only once this upload lands, so this is the other half of the
       # announcement `publish-dart.yml` sends; see the note there about why the
       # App token is not optional.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@v3.3.0
         id: app-token
         if: steps.published.outputs.skip == 'false'
         with:

.github/workflows/release.yml

@@ -121,7 +121,7 @@ jobs:
         working-directory: web
         run: pnpm install --frozen-lockfile
 
-      - uses: actions/setup-java@v6.0.1
+      - uses: actions/setup-java@v6.1.0
         with:
           distribution: temurin
           java-version: "21"
@@ -136,7 +136,7 @@ jobs:
           dart pub global activate cider
           echo "$HOME/.pub-cache/bin" >> "$GITHUB_PATH"
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@v3.3.0
         id: app-token
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
@@ -235,7 +235,7 @@ jobs:
       - name: Check the scaffolder's floors are installable
         run: node server/packages/create-eigen-game/scripts/check-pins.mjs
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@v3.3.0
         id: app-token
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}

.github/workflows/sync-compatibility.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@v3.3.0
         id: app-token
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}

.github/workflows/tag-dart-packages.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@v3.3.0
         id: app-token
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}

.github/workflows/version-dart-package.yml

@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@v3.3.0
         id: app-token
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}

docs/blockers.md

@@ -1,86 +1,118 @@
 # Upstream blockers
 
 Limitations that still require a compatibility choice in the platform.
-Last checked: **2026-10-27**. Remove entries when their workaround is removed.
+Last checked: **2026-11-02**. See [the dependency review](dependency-review-2026-11-02.md).
 
-## Android built-in Kotlin migration
+## Android built-in Kotlin and new DSL
 
-**Status:** Still blocked by `in_app_review` 2.0.12.
+**Status:** Keep `android.builtInKotlin=false` and `android.newDsl=false`.
 
-The upgraded FlutterFire packages and `app_settings` 9.0.1 now guard their
-Kotlin Gradle Plugin application when AGP built-in Kotlin is enabled.
-`in_app_review` still unconditionally applies `kotlin-android`. Keep Flutter's
-default compatibility opt-out until that plugin supports built-in Kotlin.
-The Flutter warning scans source text, so its list can include plugins whose
-application is already correctly guarded; inspect the resolved Gradle code.
+These are independent blockers, verified with a fresh Flutter 3.47.9 app:
 
-`image_cropper` 13 also removes its old Android DSL dependency. Do not switch
-all apps to the new DSL/Kotlin together until the remaining plugin supports it.
-Then generate a fresh scaffold and build Android debug and release with both
-compatibility flags removed before deleting this entry.
+- With built-in Kotlin enabled and the legacy DSL retained, `in_app_review`
+  2.0.12 fails at `android/build.gradle:25` because it unconditionally applies
+  `kotlin-android`. It is still the latest published version; its last fix
+  handles a background-Activity null pointer, not built-in Kotlin.
+- With the new DSL enabled, Flutter's Gradle plugin fails while applying to the
+  app: `ApplicationExtensionImpl` cannot be cast to `AbstractAppExtension`.
+  Updating individual plugins cannot repair this SDK-side compatibility issue.
+
+FlutterFire and `app_settings` already guard their Kotlin plugin application.
+Their presence in Flutter's source-text warning is not evidence they still
+block the migration. `image_cropper` 13 also removed its old DSL dependency.
+
+Recheck the stable SDK and the published `in_app_review` Gradle script. Remove
+these flags only after a fresh scaffold builds Android debug and release with
+the corresponding migration enabled. Do not patch cached plugin sources or
+force Gradle plugin versions across consumers.
 
 References: [Flutter app migration](https://docs.flutter.dev/release/breaking-changes/migrate-to-built-in-kotlin/for-app-developers),
-[in_app_review source](https://github.com/britannio/in_app_review/blob/master/in_app_review/android/build.gradle),
-[app_settings changelog](https://pub.dev/packages/app_settings/changelog).
+[in_app_review changelog](https://pub.dev/packages/in_app_review/changelog).
+
+## Dart analyzer and generator graph
 
-## Dart documentation and analyzer toolchain
+**Status:** Keep Freezed 4.0.1 and the resolvable analyzer-13 generator graph
+with Flutter 3.47.9 / Dart 3.13.7.
 
-**Status:** Keep `dartdoc: 9.0.8` and Freezed 4.0.1 with Flutter 3.47.7 / Dart 3.13.5.
+The stable SDK still pins `test_api` 0.7.12 and matcher 0.12.20. Resolution
+therefore selects test 1.31.1, whose analyzer constraint is below 14. Actual Pub
+dry runs reject Freezed 4.0.3 and Dartdoc 9.0.11, which require analyzer 14 and
+14.5 respectively. Upgrading the SDK patch does not unblock those tools.
 
-The SDK's bundled dartdoc revision is still `9.0.6-wip`; it crashes parsing
-`@docImport` comments inherited from dependencies. The root's pinned 9.0.8
-contains the offset fix, and `tool/check.sh` invokes that version explicitly.
+There is also an independent build-system constraint: build_runner 2.17.1
+requires build 5, while even the latest riverpod_generator 4.0.9 requires build below 5. The
+resolved build_runner 2.16.1 and source_gen 4.2.4 are intentional, not missed
+updates. Do not bypass these constraints with overrides.
 
-Newer dartdoc (9.0.11) and Freezed (4.0.3) need analyzer 14. The SDK's
-`flutter_test` pins matcher 0.12.20, resolving test 1.31.1 / test_core 0.6.18,
-which require analyzer below 14. Build runner 2.17.1, build 5 and source_gen
-4.3.1 are also outside this compatible graph. Do not override these constraints:
-they represent compiler API compatibility, not a cosmetic solver obstacle.
+The old root Dartdoc 9.0.8 workaround has been removed. With that dependency
+absent, the pinned SDK's `dart doc --dry-run` succeeds for Flutter, shell and
+Firebase, and a full Flutter documentation build produces an index. This is a
+result for the current graph, not a claim that the SDK changed its Dartdoc
+revision: Dart 3.13.5 and 3.13.7 still record the same upstream Dartdoc commit.
 
-When a stable Flutter SDK relaxes the test stack, resolve the complete workspace
-again, regenerate all packages, and run tests and documentation checks. Remove
-the dartdoc dependency only after the SDK's own `dart doc` succeeds on Flutter,
-shell and Firebase packages.
+Other unavailable transitive majors remain owned by their dependents:
+built_collection 6, cross_file 0.4, qr 4 and package_config 3 do not resolve in
+this workspace. Re-evaluate their owners together with the SDK/generator graph,
+instead of adding direct constraints on transitive implementation details.
+The SDK itself also pins platform and material_color_utilities; their newer
+releases cannot be selected independently of the SDK.
 
-References: [dartdoc changelog](https://pub.dev/packages/dartdoc/changelog),
-[Freezed changelog](https://pub.dev/packages/freezed/changelog),
-[Dart SDK DEPS](https://github.com/dart-lang/sdk/blob/main/DEPS).
+References: [Freezed changelog](https://pub.dev/packages/freezed/changelog),
+[Dartdoc changelog](https://pub.dev/packages/dartdoc/changelog),
+[Flutter test pins](https://github.com/flutter/flutter/blob/3.47.9/packages/flutter_test/pubspec.yaml),
+[build_runner](https://pub.dev/packages/build_runner),
+[riverpod_generator](https://pub.dev/packages/riverpod_generator).
 
-## TypeScript 7 declaration generation and documentation
+## TypeScript documentation toolchain
 
-**Status:** Keep TypeScript 6.0.3 in server, generated Workers and web docs.
+**Status:** Keep TypeScript 6.0.3 in `web/`. The server hold is removed.
 
-A real build with TypeScript 7.0.2 and tsdown 0.23.2 fails because the stable
-native compiler does not provide the classic TypeScript compiler API used by
-rolldown-plugin-dts. Its native declaration generator needs TypeScript 7.1+;
-that compiler line is currently experimental. Do not add a second TypeScript
-compiler or weaken declaration generation to make a version number advance.
+tsdown 0.23.3 repaired stable TypeScript 7 support by selecting the compatible
+declaration generator. The platform uses tsdown 0.23.4 and TypeScript 7.0.2 for
+the server and generated Workers. The native compiler works without adding a
+second compiler or opting into experimental TypeScript 7.1 APIs.
 
-The docs have an independent constraint: stable TypeDoc 0.28.20 supports
-TypeScript through 6, and typedoc-plugin-markdown 4.14.1 requires TypeDoc 0.28.x.
-Recheck both pipelines before removing the Dependabot TypeScript major hold.
+Web documentation has a separate npm graph: stable TypeDoc 0.28.20 accepts
+TypeScript only through 6.0.x, and typedoc-plugin-markdown 4.14.1 requires
+TypeDoc 0.28.x. There is no newer stable supported pair. Keep only the web
+Dependabot TypeScript-major hold. Its TypeScript 6 compiler also checks the
+server source while generating the cross-package documentation.
 
-References: [TypeScript 7 announcement](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/),
-[rolldown-plugin-dts](https://github.com/sxzz/rolldown-plugin-dts#readme),
-[TypeDoc releases](https://github.com/TypeStrong/typedoc/releases).
+References: [tsdown 0.23.3](https://github.com/rolldown/tsdown/releases/tag/v0.23.3),
+[TypeDoc releases](https://github.com/TypeStrong/typedoc/releases),
+[Markdown plugin compatibility](https://typedoc-plugin-markdown.org/docs/CHANGELOG).
 
-## Development-tool audit pins
+## Development-tool audit findings
 
-**Status:** Stable upstream releases still carry affected dependencies.
-After compatible transitive updates and Cloudflare 4.153.0 / plugin 1.4.8,
-`pnpm audit` reports zero findings in the root Workbox graph, one moderate
-finding in server tools, and fourteen in web tools (2 critical, 7 high,
-4 moderate, 1 low). Counts are advisory counts, not distinct packages.
+**Status:** Stable owners still constrain affected dependencies. After compatible
+transitive refreshes, `pnpm audit` reports three root findings (2 moderate,
+1 low), one moderate
+server finding, and sixteen web findings (2 critical, 7 high, 5 moderate, 2 low).
+Counts are advisory counts, not distinct packages or deployed vulnerabilities.
 
 | Owner | Remaining dependency | Why the update stops here |
 | --- | --- | --- |
-| drizzle-kit 0.31.11 | esbuild 0.18.20 through the obsolete esbuild-kit loader | Stable Drizzle Kit still includes the loader; a newer direct esbuild does not replace its nested copy. |
-| Docusaurus 3.10.2 | tinypool 1.1.1; serialize-javascript 6.0.2; uuid 8.3.2 | Fixes require majors selected by the framework/minifier/socket owners. Docusaurus 4 is canary, not stable. |
-| docusaurus-plugin-llms 0.6.1 | minimatch 9.0.3; yaml 2.8.1 | Latest stable plugin pins these exact versions. |
-| OpenAPI docs 5.2.0 / Postman tools | yaml 1.10.2; js-yaml 4.3.0; faker 5.5.3 | Latest supported converter/collection graph still pins the older packages. |
-
-These are development/build graphs, not the deployed Hono/Worker dependency
-closure. That distinction does not make the findings resolved: tooling still
-processes repository inputs. Recheck the owners' releases and audit when they
-update; do not report the full repository audit as clean or force unrelated
-major versions with overrides merely to clear the report.
+| Workbox 7.4.1 | glob 11/minimatch 10 and deepmerge 4.3.1 | The patched glob/minimatch need new major ranges; deepmerge has no patched stable release. A compatible root refresh does not clear these new advisories. |
+| drizzle-kit 0.31.11 | esbuild 0.18.20 through the deprecated esbuild-kit loader | The latest stable Kit still includes the loader. Drizzle 1.0 is an RC; changing a direct esbuild does not replace the loader's nested copy. |
+| Docusaurus 3.10.2 and its bundler/dev server | tinypool 1.1.1, serialize-javascript 6.0.2, uuid 8.3.2 | Fixes need new major ranges from their owners. Docusaurus 4 remains canary. |
+| docusaurus-plugin-llms 0.6.1 | minimatch 9.0.3, yaml 2.8.1 | The latest plugin pins these versions exactly. |
+| OpenAPI docs 5.2.0 / Postman converter | yaml 1.10.2, js-yaml 4.3.0, older Faker | The latest supported owner graph still selects the affected versions. |
+| TypeDoc 0.28.20 | minimatch 10 | The new advisory requires minimatch 11; the owner's range excludes it. |
+| SVGR/SVGO through Docusaurus | deepmerge 4.3.1 | No patched stable deepmerge release is available. |
+
+Drizzle 1.0 RC is an available migration path, not a missing release. Its Kit
+removes the old loader but requires ORM 1.0 RC too; the upstream upgrade changes
+migration metadata/layout and several SQLite/query semantics. Evaluate the
+coordinated migration for both D1 and SQLite Durable Objects separately from
+this stable update. See [the v1 upgrade](https://orm.drizzle.team/docs/upgrade-v1)
+and [RC5 changes](https://orm.drizzle.team/docs/latest-releases/drizzle-orm-v1rc5).
+
+Joi is no longer held: refreshing the owner's compatible range selects 17.13.9,
+which fixes the email-validation denial of service. Its high advisory is gone.
+Hono's newly published router/security fixes are also taken explicitly through
+the server's `^4.13.16` minimum, rather than only updating a development lockfile.
+
+These remaining findings belong to development/build graphs rather than the
+deployed Hono/Worker closure. They remain real maintenance work because tooling
+processes repository inputs. Do not claim the full audit is clean or force
+unrelated major versions with overrides merely to clear its report.