chore: bump deps (#436)

* chore: bump deps to latest mature versions

next/posthog-js/@posthog/nextjs-config pinned to the newest releases
that clear the minimumReleaseAge supply-chain policy (today's releases
are too new); cypress stays at 15.16.0 for the same reason.

* chore: override hono <4.12.21 to >=4.12.21 for 4 moderate advisories

Transitive via @modelcontextprotocol/sdk in packages/mcp. Verified
postcss and qs overrides still map to live advisories (minimum set).

* chore: fix new oxlint 1.69 rule violations

- method-signature-style (30): interface method signatures converted
  to property signatures with function types
- prefer-named-capture-group (43): regex groups named or made
  non-capturing where the value is never read
- tsconfig target ES2017 -> ES2018 (root + app): named capture groups
  are ES2018 syntax

Author: adibarra

package.json

@@ -44,14 +44,14 @@
     "audit-ci": "^7.1.0",
     "is-ci": "^4.1.0",
     "lefthook": "^2.1.9",
-    "oxfmt": "^0.52.0",
-    "oxlint": "^1.67.0",
+    "oxfmt": "^0.54.0",
+    "oxlint": "^1.69.0",
     "rimraf": "^6.1.3",
     "typescript": "^6.0.3"
   },
   "engines": {
     "node": ">=18.0.0",
     "pnpm": ">=10.0.0"
   },
-  "packageManager": "pnpm@11.5.0"
+  "packageManager": "pnpm@11.5.2"
 }

packages/app/cypress/e2e/url-params.cy.ts

@@ -25,7 +25,7 @@ const assertNoHydrationMismatch = () => {
   cy.get('@consoleError').then((spy) => {
     const calls = (spy as unknown as { args: unknown[][] }).args;
     const hydration = calls.filter((args) =>
-      args.some((a) => typeof a === 'string' && /hydrat(ion|ed) (mismatch|failed)/iu.test(a)),
+      args.some((a) => typeof a === 'string' && /hydrat(?:ion|ed) (?:mismatch|failed)/iu.test(a)),
     );
     expect(hydration, JSON.stringify(hydration)).to.have.length(0);
   });

packages/app/package.json

@@ -32,42 +32,42 @@
     "@chenglou/pretext": "^0.0.7",
     "@jpinsonneau/html-to-image": "^1.11.13",
     "@noble/ciphers": "^2.2.0",
-    "@posthog/nextjs-config": "^1.9.37",
-    "@radix-ui/react-accordion": "^1.2.12",
-    "@radix-ui/react-dialog": "^1.1.15",
-    "@radix-ui/react-label": "^2.1.8",
-    "@radix-ui/react-popover": "^1.1.15",
-    "@radix-ui/react-select": "^2.2.6",
-    "@radix-ui/react-slot": "^1.2.4",
-    "@radix-ui/react-switch": "^1.2.6",
-    "@radix-ui/react-tabs": "^1.1.13",
-    "@radix-ui/react-tooltip": "^1.2.8",
+    "@posthog/nextjs-config": "^1.9.54",
+    "@radix-ui/react-accordion": "^1.2.13",
+    "@radix-ui/react-dialog": "^1.1.16",
+    "@radix-ui/react-label": "^2.1.9",
+    "@radix-ui/react-popover": "^1.1.16",
+    "@radix-ui/react-select": "^2.3.0",
+    "@radix-ui/react-slot": "^1.2.5",
+    "@radix-ui/react-switch": "^1.3.0",
+    "@radix-ui/react-tabs": "^1.1.14",
+    "@radix-ui/react-tooltip": "^1.2.9",
     "@react-three/fiber": "^9.6.1",
     "@semianalysisai/inferencex-constants": "workspace:*",
     "@semianalysisai/inferencex-db": "workspace:*",
-    "@shikijs/rehype": "^4.1.0",
-    "@tailwindcss/typography": "^0.5.19",
-    "@tanstack/react-query": "^5.100.14",
+    "@shikijs/rehype": "^4.2.0",
+    "@tailwindcss/typography": "^0.5.20",
+    "@tanstack/react-query": "^5.101.0",
     "@vercel/analytics": "^2.0.1",
     "@vercel/blob": "^2.4.0",
     "@vercel/speed-insights": "^2.0.0",
     "adm-zip": "^0.5.17",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "d3": "^7.9.0",
-    "dompurify": "^3.4.7",
+    "dompurify": "^3.4.8",
     "gray-matter": "^4.0.3",
     "iwanthue": "^2.0.0",
     "lucide-react": "^1.17.0",
     "mp4-muxer": "^5.2.2",
-    "next": "^16.2.6",
+    "next": "^16.2.7",
     "next-mdx-remote": "^6.0.0",
     "next-themes": "^0.4.6",
-    "posthog-js": "^1.376.3",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "posthog-js": "^1.383.1",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "remark-gfm": "^4.0.1",
-    "shiki": "^4.1.0",
+    "shiki": "^4.2.0",
     "tailwind-merge": "^3.6.0",
     "three": "^0.184.0"
   },
@@ -77,11 +77,11 @@
     "@types/adm-zip": "^0.5.8",
     "@types/d3": "^7.4.3",
     "@types/mdast": "^4.0.4",
-    "@types/node": "^25.9.1",
-    "@types/react": "^19.2.15",
+    "@types/node": "^25.9.2",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@types/three": "^0.184.1",
-    "@vitest/coverage-v8": "^4.1.7",
+    "@vitest/coverage-v8": "^4.1.8",
     "cypress": "^15.16.0",
     "cypress-split": "^1.24.31",
     "dotenv": "^17.4.2",
@@ -90,10 +90,10 @@
     "fake-indexeddb": "^6.2.5",
     "jsdom": "^29.1.1",
     "tailwindcss": "^4.3.0",
-    "tsx": "^4.22.3",
+    "tsx": "^4.22.4",
     "tw-animate-css": "^1.4.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.8"
   },
   "engines": {
     "node": ">=18.0.0",

packages/app/src/components/evaluation/ui/BarChartD3.tsx

@@ -180,7 +180,7 @@ export default function EvalBarChartD3({ caption }: { caption?: ReactNode }) {
       if (url) {
         const direct = runIndexByUrl[url];
         if (direct !== undefined) return unofficialRunInfos[direct]?.branch;
-        const idMatch = url.match(/\/runs\/(\d+)/u);
+        const idMatch = url.match(/\/runs\/(?<runId>\d+)/u);
         if (idMatch) {
           const viaId = runIndexByUrl[idMatch[1]];
           if (viaId !== undefined) return unofficialRunInfos[viaId]?.branch;

packages/app/src/components/evaluation/ui/EvalSamplesDrawer.tsx

@@ -338,8 +338,8 @@ interface FilterChipProps {
  */
 function extractRunIdFromUrl(url: string | undefined): string | null {
   if (!url) return null;
-  const m = url.match(/\/actions\/runs\/(\d+)/u);
-  return m ? m[1] : null;
+  const m = url.match(/\/actions\/runs\/(?<runId>\d+)/u);
+  return m?.groups?.runId ?? null;
 }
 
 function FilterChip({ label, count, active, onClick, tone }: FilterChipProps) {

packages/app/src/components/inference/replay/exportMp4.ts

@@ -59,7 +59,7 @@ interface ExportOptions {
   signal?: AbortSignal;
 }
 
-const CSS_VAR_RE = /var\(--([^)]+)\)/u;
+const CSS_VAR_RE = /var\(--(?<varName>[^)]+)\)/u;
 const WATERMARK_HEIGHT = 48;
 const WATERMARK_TEXT = 'InferenceX — github.com/SemiAnalysisAI/InferenceX';
 

packages/app/src/components/inference/ui/ChartDisplay.tsx

@@ -192,7 +192,7 @@ export default function ChartDisplay() {
         const info = unofficialRunInfos[runIndexByUrl[url]];
         return info ? { branch: info.branch, url: info.url } : undefined;
       }
-      const idMatch = url.match(/\/runs\/(\d+)/u);
+      const idMatch = url.match(/\/runs\/(?<runId>\d+)/u);
       if (idMatch && idMatch[1] in runIndexByUrl) {
         const info = unofficialRunInfos[runIndexByUrl[idMatch[1]]];
         return info ? { branch: info.branch, url: info.url } : undefined;

packages/app/src/components/inference/utils/paretoLabels.ts

@@ -46,8 +46,8 @@ export const parseLabelComponents = (label: string): string[] => {
   const parts = label.split('+');
   return parts.map((p) => {
     // Strip the leading "NxNNN" multiplier (e.g., "1x" or "3x")
-    const match = p.match(/^\d+x(.+)$/u);
-    return match ? match[1] : p;
+    const match = p.match(/^\d+x(?<strategy>.+)$/u);
+    return match?.groups?.strategy ?? p;
   });
 };
 

packages/app/src/components/inference/utils/tooltipUtils.ts

@@ -88,7 +88,8 @@ const runLinkHTML = (runUrl?: string) =>
 const tooltipLine = (label: string, value: string | number) =>
   `<div style="color: var(--muted-foreground); font-size: 11px; margin-bottom: 4px;"><strong>${label}:</strong> ${value}</div>`;
 
-const shortenSha = (image: string) => image.replaceAll(/(sha256:[a-f0-9]{7})[a-f0-9]+/giu, '$1…');
+const shortenSha = (image: string) =>
+  image.replaceAll(/(?<shaPrefix>sha256:[a-f0-9]{7})[a-f0-9]+/giu, '$<shaPrefix>…');
 
 const imageTooltipLine = (image: string) =>
   `<div style="color: var(--muted-foreground); font-size: 11px; margin-bottom: 4px;">

packages/app/src/components/json-ld.test.ts

@@ -9,7 +9,7 @@ function render(data: object): string {
 }
 
 function scriptBody(html: string): string {
-  const match = html.match(/<script[^>]*>([\s\S]*?)<\/script[^>]*>/iu);
+  const match = html.match(/<script[^>]*>(?<body>[\s\S]*?)<\/script[^>]*>/iu);
   if (!match) throw new Error(`no <script> in: ${html}`);
   return match[1];
 }