build(deps): consolidate dependency updates

[meysam-licenseware]

Consolidates the open dependency PRs into one bump, with every package at its latest release except TypeScript (see below).

Supersedes #75 (partly), #82, #83, #87, #88, #89, #90, #91, #94, #95, #96, #97, #98, #99 and #3.

What changed

Area	Update	Code change needed
Frontend	vitest + @vitest/coverage-v8 4 → 5, @vueuse/core 14 → 15, @types/node 25 → 26, prettier-plugin-tailwindcss 0.7 → 0.8, lockfile refresh (vue 3.5.43, vue-router 5.4, zod 4.6, vite 8.3, @lucide/vue 1.53, …)	none
Go	chi v5.3.2, urfave/cli v3.14.0 (#94 had v3.13.0), meysam81/x/logging b9e8862	none
Dev stack	oryd/kratos v1.3.1 → v26.2.0, oryd/oathkeeper v0.40.9 → v26.2.0, postgres 17 → 18	yes, see below
CI	codecov, setup-qemu, setup-buildx digests (each checked against its upstream tag)	none
Lint	.golangci.yml RealIP exclusion	yes, see below

Changes needed for compatibility

• Postgres 18 (build(deps): update postgres docker tag to v18 - autoclosed #91 alone does not start): the image keeps its data under /var/lib/postgresql/18/docker and refuses a volume mounted at /var/lib/postgresql/data, even an empty one. The volume is now mounted at /var/lib/postgresql and renamed to pgdata. An existing Postgres 17 volume is refused too, so the rename lets just up start cleanly and leaves the old volume intact. Remove it with docker volume rm ory-admin-ui_postgres when you no longer need it.
• Kratos v26: migrate sql -e --yes is deprecated. It is now migrate sql up -e --yes, which also works on v1.3.1. dev/kratos.yml and dev/oathkeeper.yml validate against the v26.2.0 config schemas unchanged.
• checks was red on main: staticcheck prints SA1019: github.com/go-chi/chi/v5/middleware.RealIP is deprecated, which the exclusion text never matched. The regex now matches the full path, and any other SA1019 is still reported.

Not included

• TypeScript 7 (build(deps): update dependency typescript to v7 #75): vue-tsc loads TypeScript's JS API, which TS 7 does not ship. Both typecheck and build fail with ERR_PACKAGE_PATH_NOT_EXPORTED, reproduced locally. TS stays on 6.0.3, the latest 6.x.
• [pre-commit.ci] pre-commit autoupdate #3 (pre-commit.ci, Jan 2025): every hook in it is already newer on main.

Behaviour

• One visible difference. @lucide/vue redrew the key glyph (fix(icons): rotate key icon lucide-icons/lucide#3111), so the Sessions icon in the sidebar is mirrored. Lucide also dropped the lucide-*-icon alias classes (nothing here uses them) and now sets aria-hidden="true" on icons.
• --help output. It no longer lists -h under --help. With urfave/cli 3.14 duplicate flag names are rejected, and -h always parsed as --host. Parsing is unchanged.
• Kratos ≥ v25 (upstream change, SPA untouched). Kratos no longer sends x-total-count on /admin/sessions and /admin/courier/messages. Against such a server, the dashboard's Active Sessions and Messages tiles fall back to the length of the first page (10).

Verification

Gates were run before and after on a clean bun install --frozen-lockfile:

Check	main	this branch
bun run typecheck	pass	pass
bun run lint	3 warnings	the same 3 warnings
prettier --check .	clean	clean
bun run test:ci	348/348 passed	348/348 passed, thresholds still enforced
bun run build	156 files	156 files, same chunk layout
golangci-lint	1 issue	0 issues
go vet, go mod verify	pass	pass

• Browser A/B (main build vs branch build). Both production builds ran against the same seeded stack (just seed). Two stacks were used: main's compose (Kratos v1.3.1) and this branch's compose (Kratos/Oathkeeper v26.2.0, Postgres 18). Each pass covered 16 routes, including identity/session detail and cursor pagination clicked through with page_size=2.
  • Rendered text and every API request + status: identical on all routes, on both stacks.
  • Screenshots at a fixed viewport: the only non-noise difference is the 19×19 px Sessions icon. A main-vs-main control run set the noise floor.
• Go server. Old vs new binary: identical --help/version/flag parsing, and byte-identical HTTP responses across 12 probes.
• Docker image. Built locally from Dockerfile (CI builds it only on main). Index, health and brotli assets were served.
• Dev stack. Started fresh, and again with an existing Postgres 17 volume present. Migrations ran with no deprecation warning and the seed passed 32/32.

🤖 Generated with Claude Code