chore(deps): consolidate dependabot updates

Consolidates Dependabot group PR #1461 (all-minor-patch, 38 pkgs) and
#1455 (@types/node) into one tested branch. All frontend (npm/pnpm);
no Python deps changed.

Application dependencies (js/package.json):
- @amplitude/unified: 1.1.16 → 1.1.21
- @codemirror/state: ^6.6.0 → ^6.7.1
- @codemirror/view: ^6.43.1 → ^6.43.6
- @mui/material: ^9.1.1 → ^9.2.0
- @mui/system: ^9.1.1 → ^9.2.0
- @next/third-parties: 16.2.9 → 16.2.10
- @sentry/nextjs: ^10.58.0 → ^10.64.0
- @sentry/react: ^10.58.0 → ^10.64.0
- @tailwindcss/postcss: ^4.3.1 → ^4.3.2
- @tanstack/react-query: 5.100.14 → 5.101.2
- @uiw/codemirror-theme-github: ^4.25.10 → ^4.25.11
- @uiw/react-codemirror: ^4.25.10 → ^4.25.11
- @xyflow/react: ^12.11.0 → ^12.11.2
- @zumer/snapdom: ^2.12.9 → ^2.15.0
- import-in-the-middle: ^3.1.0 → ^3.3.1
- next: 16.2.9 → 16.2.10
- posthog-js: ^1.390.2 → ^1.399.2
- react-icons: ^5.6.0 → ^5.7.0

Dev dependencies (js/package.json, storybook, ui devDeps):
- @amplitude/analytics-core: ^2.50.0 → ^2.52.1
- @biomejs/biome: 2.5.0 → 2.5.3
- @types/node: ^25.9.3 → ^26.1.0 (#1455)
- @vitejs/plugin-react: ^6.0.2 → ^6.0.3
- @vitest/coverage-v8, vitest: ^4.1.9 → ^4.1.10
- @vitest/browser-playwright: ^4.1.9 → ^4.1.10 (storybook)
- @playwright/test, playwright: ^1.61.0 → ^1.61.1 (storybook)
- msw: ^2.14.6 → ^2.15.0 (storybook)
- baseline-browser-mapping: ^2.10.38 → ^2.10.42
- fast-check: ^4.8.0 → ^4.9.0
- globals: ^17.6.0 → ^17.7.0
- postcss: ^8.5.15 → ^8.5.16
- read-excel-file: ^9.2.0 → ^9.3.0
- tailwindcss: ^4.3.1 → ^4.3.2
- @tailwindcss/cli, @tsdown/css, tsdown, typedoc (ui devDeps)

pnpm-workspace.yaml overrides bumped to unclamp the group targets
(exact pins that otherwise hold the locked version):
- @tanstack/react-query: 5.101.0 → 5.101.2
- @biomejs/biome: 2.5.0 → 2.5.3
- @amplitude/unified: 1.1.16 → 1.1.21

Consumer-facing @datarecce/ui `dependencies` floors intentionally left
unchanged (only devDeps bumped) per js/packages/ui/DEPENDENCIES.md.

biome 2.5.0 → 2.5.3 acked per the js/.husky/pre-commit guard (DRC-3460):
re-verified `biome check` clean on macOS arm64 (no stack overflow) and
bumped EXPECTED_BIOME to 2.5.3 in the same commit.

Also fixes a Biome 2.5.3 noUnsafeOptionalChaining error surfaced in
toDataDiffGrid.test.ts by the linter bump (removed redundant optional
chaining inside a guarded block).

ag-grid v36 (PRs #1454, #1456) deferred — see PR body.

Refs: #1461, #1455
Signed-off-by: Jared Scott <jared.scott@datarecce.io>

Author: gcko

js/.husky/pre-commit

@@ -16,7 +16,7 @@ export GIT_WORK_TREE="$REPO_ROOT"
 #   ALLOW_BIOME_BUMP=1 git commit ...
 PINNED_PKG_JSON="js/package.json"
 if git diff --cached --name-only --diff-filter=ACM | grep -qx "$PINNED_PKG_JSON"; then
-    # Pinned: @biomejs/biome → 2.5.0.
+    # Pinned: @biomejs/biome → 2.5.3.
     #
     # Rationale: biome 2.4.12 through 2.4.16 have a deterministic Rust stack
     # overflow on macOS arm64 when running TS-aware nursery rules
@@ -26,14 +26,15 @@ if git diff --cached --name-only --diff-filter=ACM | grep -qx "$PINNED_PKG_JSON"
     # 2.4.16 locally on 2026-05-28 and CONFIRMED it still crashes — see
     # DataRecce/recce-cloud-infra#1382 for the testing notes.
     #
-    # 2.5.0 is ABOVE the affected 2.4.12–2.4.16 range and verified clean on
-    # macOS arm64 (`biome check src/` + `packages/ui/src/` exit 0, no stack
-    # overflow). Bumped to 2.5.0 in #1435; this guard was left at 2.4.15 by
-    # that PR and reconciled here. The js/biome.json in this repo does NOT
+    # 2.5.3 is ABOVE the affected 2.4.12–2.4.16 range and verified clean on
+    # macOS arm64 (`biome check --staged` + `biome check src/` exit 0, no stack
+    # overflow). Bumped 2.5.0 → 2.5.3 in the dependabot consolidation (group PR
+    # #1461); re-verified on macOS arm64 before acking. Prior: 2.5.0 in #1435,
+    # 2.4.15 guard reconciled then. The js/biome.json in this repo does NOT
     # currently enable those nursery rules either. A silent dependabot bump
     # still requires deliberate ack: when changing biome, update EXPECTED_BIOME
     # in the same commit as the bump (and re-run the macOS arm64 check above).
-    EXPECTED_BIOME="2.5.0"
+    EXPECTED_BIOME="2.5.3"
     # head -1 hardens against a future pnpm.overrides entry adding a second
     # "@biomejs/biome": line. Fail-loud (below) if extraction is empty so a
     # package.json reformat (or removed dep) can't silently disable the guard.

js/package.json

@@ -24,33 +24,33 @@
     "prepare": "cd .. && husky js/.husky"
   },
   "dependencies": {
-    "@amplitude/unified": "1.1.16",
+    "@amplitude/unified": "1.1.21",
     "@babel/helpers": "^8.0.0",
     "@babel/runtime": "^8.0.0",
     "@codemirror/lang-sql": "^6.10.0",
     "@codemirror/lang-yaml": "^6.1.3",
     "@codemirror/merge": "^6.12.2",
-    "@codemirror/state": "^6.6.0",
-    "@codemirror/view": "^6.43.1",
+    "@codemirror/state": "^6.7.1",
+    "@codemirror/view": "^6.43.6",
     "@dagrejs/dagre": "3.0.0",
     "@datarecce/ui": "workspace:*",
     "@emotion/react": "^11.14.0",
     "@emotion/styled": "^11.14.1",
     "@fontsource/montserrat": "^5.2.8",
     "@hello-pangea/dnd": "^18.0.1",
     "@jeromefitz/date-fns-tz": "3.0.0-canary.8",
-    "@mui/material": "^9.1.1",
-    "@mui/system": "^9.1.1",
-    "@next/third-parties": "16.2.9",
-    "@sentry/nextjs": "^10.58.0",
-    "@sentry/react": "^10.58.0",
-    "@tailwindcss/postcss": "^4.3.1",
-    "@tanstack/react-query": "5.100.14",
+    "@mui/material": "^9.2.0",
+    "@mui/system": "^9.2.0",
+    "@next/third-parties": "16.2.10",
+    "@sentry/nextjs": "^10.64.0",
+    "@sentry/react": "^10.64.0",
+    "@tailwindcss/postcss": "^4.3.2",
+    "@tanstack/react-query": "5.101.2",
     "@types/js-cookie": "^3.0.6",
-    "@uiw/codemirror-theme-github": "^4.25.10",
-    "@uiw/react-codemirror": "^4.25.10",
-    "@xyflow/react": "^12.11.0",
-    "@zumer/snapdom": "^2.12.9",
+    "@uiw/codemirror-theme-github": "^4.25.11",
+    "@uiw/react-codemirror": "^4.25.11",
+    "@xyflow/react": "^12.11.2",
+    "@zumer/snapdom": "^2.15.0",
     "ag-grid-community": "^35.3.1",
     "ag-grid-react": "^35.3.1",
     "chart.js": "^4.5.1",
@@ -59,16 +59,16 @@
     "date-fns": "^4.4.0",
     "file-saver": "^2.0.5",
     "happy-dom": "^20.10.6",
-    "import-in-the-middle": "^3.1.0",
+    "import-in-the-middle": "^3.3.1",
     "js-cookie": "^3.0.8",
     "lodash": "^4.18.1",
-    "next": "16.2.9",
+    "next": "16.2.10",
     "next-themes": "^0.4.6",
-    "posthog-js": "^1.390.2",
+    "posthog-js": "^1.399.2",
     "react": "19.2.6",
     "react-chartjs-2": "^5.3.1",
     "react-dom": "19.2.6",
-    "react-icons": "^5.6.0",
+    "react-icons": "^5.7.0",
     "react-markdown": "^10.1.0",
     "react-split": "^2.0.14",
     "react-syntax-highlighter": "^16.1.1",
@@ -81,31 +81,31 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@amplitude/analytics-core": "^2.50.0",
-    "@biomejs/biome": "2.5.0",
+    "@amplitude/analytics-core": "^2.52.1",
+    "@biomejs/biome": "2.5.3",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",
     "@testing-library/user-event": "14.6.1",
     "@types/common-tags": "^1.8.4",
     "@types/file-saver": "^2.0.7",
     "@types/lodash": "^4.17.24",
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.1.0",
     "@types/react": "19.2.15",
     "@types/react-dom": "19.2.3",
     "@types/react-syntax-highlighter": "^15.5.13",
-    "@vitejs/plugin-react": "^6.0.2",
-    "@vitest/coverage-v8": "^4.1.9",
-    "baseline-browser-mapping": "^2.10.38",
-    "fast-check": "^4.8.0",
-    "globals": "^17.6.0",
+    "@vitejs/plugin-react": "^6.0.3",
+    "@vitest/coverage-v8": "^4.1.10",
+    "baseline-browser-mapping": "^2.10.42",
+    "fast-check": "^4.9.0",
+    "globals": "^17.7.0",
     "husky": "^9.1.7",
-    "postcss": "^8.5.15",
-    "read-excel-file": "^9.2.0",
+    "postcss": "^8.5.16",
+    "read-excel-file": "^9.3.0",
     "rimraf": "^6.1.3",
-    "tailwindcss": "^4.3.1",
+    "tailwindcss": "^4.3.2",
     "typescript": "^6.0.3",
-    "vite": "^8.0.16",
-    "vitest": "^4.1.9"
+    "vite": "^8.1.4",
+    "vitest": "^4.1.10"
   }
 }

js/packages/storybook/package.json

@@ -13,24 +13,24 @@
   },
   "dependencies": {
     "@datarecce/ui": "workspace:*",
-    "@tanstack/react-query": "5.100.14"
+    "@tanstack/react-query": "5.101.2"
   },
   "devDependencies": {
-    "@playwright/test": "^1.61.0",
+    "@playwright/test": "^1.61.1",
     "@storybook/addon-docs": "^10.4.6",
     "@storybook/addon-vitest": "^10.4.6",
     "@storybook/react": "^10.4.6",
     "@storybook/react-vite": "^10.4.6",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",
-    "@vitejs/plugin-react": "^6.0.2",
-    "@vitest/browser-playwright": "^4.1.9",
-    "@vitest/coverage-v8": "^4.1.9",
+    "@vitejs/plugin-react": "^6.0.3",
+    "@vitest/browser-playwright": "^4.1.10",
+    "@vitest/coverage-v8": "^4.1.10",
     "chartjs-adapter-date-fns": "^3.0.0",
-    "msw": "^2.14.6",
-    "playwright": "^1.61.0",
+    "msw": "^2.15.0",
+    "playwright": "^1.61.1",
     "storybook": "^10.4.6",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",

js/packages/ui/package.json

@@ -175,14 +175,14 @@
     "yaml": "^2.8.0"
   },
   "devDependencies": {
-    "@tailwindcss/cli": "^4.2.4",
-    "@tailwindcss/postcss": "^4.2.4",
-    "@tsdown/css": "^0.22.0",
-    "postcss": "^8.5.15",
-    "read-excel-file": "^9.0.6",
-    "tailwindcss": "^4.2.4",
-    "tsdown": "^0.22.0",
-    "typedoc": "^0.28.19",
+    "@tailwindcss/cli": "^4.3.2",
+    "@tailwindcss/postcss": "^4.3.2",
+    "@tsdown/css": "^0.22.4",
+    "postcss": "^8.5.16",
+    "read-excel-file": "^9.3.0",
+    "tailwindcss": "^4.3.2",
+    "tsdown": "^0.22.4",
+    "typedoc": "^0.28.20",
     "typedoc-plugin-markdown": "^4.11.0",
     "typescript": "^6.0.3"
   },