chore(deps): update dependencies to latest versions (#1321)

## Summary

Applies all pending Renovate PRs plus additional updates discovered via
`bun outdated`. Fixes the `axios` override conflict that was blocking
`npm-check-updates`, and adapts CI + the Cypress e2e suite to the
updated dependencies.

### Conflict Fix
- `axios`: unpinned exact `1.16.1` → `^1.18.0`; aligned
`overrides.axios` from `^1.15.0` → `^1.18.0`

### Range Fixes (were outside previous semver range)
- `@conform-to/react` + `@conform-to/zod`: pinned `1.19.3` → `^1.19.4`
- `@opentelemetry/*`: `^0.218.0` → `^0.219.0`, auto-instrumentations
`^0.76.0` → `^0.77.0`
- `@hey-api/openapi-ts`: `^0.97.0` → `^0.99.0`

### Major Updates (datum-ui peer dep aligned)
- `react-day-picker`: `^9.14.0` → `^10` — datum-ui v1.3.0 compatible,
typecheck clean
- `@stepperize/react`: `^6.1.0` → `^7` — optional peer dep, typecheck
clean
- `js-yaml`: `^4` → `^5` — datum-ui peer dep, typecheck clean
- `@types/node`: `^25` → `^26` — typecheck clean

### Minor/Patch Bumps (~50 packages)
React Router `7.16→7.18`, Sentry `10.56→10.59`, Tiptap `3.24→3.27`, AI
SDK, lucide-react, isomorphic-dompurify, hono, ioredis, eslint,
prettier, cypress `15.14→15.17`, typescript-eslint, tailwindcss,
`@datum-cloud/datum-ui` `1.2.0→1.3.0`, and more.

### Skipped (framework migrations requiring dedicated PRs)
- `react-router` / `@react-router/*` v8
- `vite` v8 + `@vitejs/plugin-react` v6
- `graphql` v17
- `remix-utils` v10

## CI & E2E Fixes

The dependency bump surfaced several CI/test failures that are fixed in
this PR (commit `fix(ci): adapt CI and e2e suite to updated
dependencies`):

- **`.github/workflows/ci.yml`** — share the build output between jobs
via `upload-artifact`/`download-artifact` instead of `actions/cache`
(the e2e jobs were failing with `Cannot find module
'../build/server/index.js'`), and pin Node.js 24 (`.nvmrc`) for the
Cypress jobs.
- **`vite.config.ts`** — lazy-load `@react-router/dev/vite` when
`CYPRESS` is set, so Cypress runs no longer crash on the react-router
7.18 esbuild path.
- **`cypress.config.ts`** — replace `require('react-router')` with a
dynamic `import()` (react-router 7.18+ is ESM-only) in the
`signSessionCookie` task, and guard against a missing `SESSION_SECRET`.
- **`cypress/support/e2e.ts`** — neutralize Radix's close-on-window-blur
behavior. `@radix-ui/react-menu` ≥2.1.17 (via `@datum-cloud/datum-ui`
1.3.0) registers a `window` `blur` listener that closes any open
`DropdownMenu`/`Select`/`Popover`. In headless runs the AUT window
routinely lacks OS focus, firing spurious `blur` events that close the
user menu the instant it opens — the smoke test failed with
`[data-e2e="user-menu-logout"]` "never found". A capture-phase `blur`
listener registered at page load (before React/Radix mount) stops the
event before Radix's handler runs, keeping menus open in tests.
Production behavior is untouched.
- **`cypress/e2e/smoke/auth.cy.ts`** — open the user menu with plain
`.click()` (the Radix dropdown does not open via `pointerdown` alone).

## Test plan
- [x] `bun run typecheck` — passes clean
- [x] `bun run lint` — 0 errors (2 pre-existing warnings unrelated to
deps)
- [x] Verify date-picker and calendar components render correctly
- [x] Verify stepper/wizard flows work (service account wizard, export
policy stepper)
- [x] CI green across all jobs (Build, Unit, Bun Unit, **E2E Smoke**,
Lint, Type Check)

Author: yahyafakhroji

.github/workflows/ci.yml

@@ -87,10 +87,11 @@ jobs:
             **/node_modules
           key: ${{ runner.os }}-deps-${{ hashFiles('**/bun.lock', '**/bun.lockb', '**/package.json') }}
       - run: bun run build
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
+          name: build-${{ github.sha }}
           path: build
-          key: build-${{ github.sha }}
+          retention-days: 1
 
   # ─── Tests ──────────────────────────────────────────────────
   bun-tests:
@@ -128,6 +129,9 @@ jobs:
     if: ${{ !failure() && !cancelled() }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with: { bun-version: 1.3.14 } # renovate: datasource=docker depName=oven/bun
       - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -150,6 +154,9 @@ jobs:
     if: ${{ !failure() && !cancelled() }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with: { bun-version: 1.3.14 } # renovate: datasource=docker depName=oven/bun
       - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -158,10 +165,10 @@ jobs:
             ${{ env.BUN_CACHE }}
             **/node_modules
           key: ${{ runner.os }}-deps-${{ hashFiles('**/bun.lock', '**/bun.lockb', '**/package.json') }}
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - uses: actions/download-artifact@v4
         with:
+          name: build-${{ github.sha }}
           path: build
-          key: build-${{ github.sha }}
       - name: Setup Environment
         env:
           SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
@@ -220,6 +227,9 @@ jobs:
         shard: [0, 1, 2, 3]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with: { bun-version: 1.3.14 } # renovate: datasource=docker depName=oven/bun
       - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -228,10 +238,10 @@ jobs:
             ${{ env.BUN_CACHE }}
             **/node_modules
           key: ${{ runner.os }}-deps-${{ hashFiles('**/bun.lock', '**/bun.lockb', '**/package.json') }}
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - uses: actions/download-artifact@v4
         with:
+          name: build-${{ github.sha }}
           path: build
-          key: build-${{ github.sha }}
       - name: Setup Environment
         env:
           SESSION_SECRET: ${{ secrets.SESSION_SECRET }}

bun.lock

@@ -53,17 +53,21 @@ export default defineConfig({
 
           return null;
         },
-        signSessionCookie(sessionData: { accessToken: string; expiredAt: string; sub: string }) {
-          // Import React Router's cookie utilities to sign the cookie properly
-          const { createCookie, createCookieSessionStorage } = require('react-router');
+        async signSessionCookie(sessionData: {
+          accessToken: string;
+          expiredAt: string;
+          sub: string;
+        }) {
+          // react-router 7.18+ ships ESM-only — require() is not available
+          const { createCookie, createCookieSessionStorage } = await import('react-router');
           const sessionSecret = process.env.SESSION_SECRET;
 
           const sessionCookie = createCookie('_session', {
             path: '/',
             sameSite: 'lax',
             httpOnly: true,
             maxAge: 60 * 60 * 13, // 13 hours
-            secrets: [sessionSecret],
+            secrets: sessionSecret ? [sessionSecret] : [],
             secure: process.env.NODE_ENV === 'development' ? false : true,
           });
 
@@ -74,11 +78,11 @@ export default defineConfig({
           // Create a session and commit it to get the signed cookie value
           return sessionStorage
             .getSession()
-            .then((session: ReturnType<typeof createCookieSessionStorage>['getSession']) => {
+            .then((session) => {
               session.set('_session', sessionData);
               return sessionStorage.commitSession(session);
             })
-            .then((cookieHeader: string) => {
+            .then((cookieHeader) => {
               // Extract just the cookie value from the Set-Cookie header
               // Format: "_session=value; Path=/; ..."
               const match = cookieHeader.match(/^_session=([^;]+)/);

cypress.config.ts

@@ -34,7 +34,9 @@ describe('Authentication — smoke', () => {
     cy.visit(paths.account.organizations.root);
     cy.url().should('include', paths.account.organizations.root);
 
-    // Open user menu and click Log Out
+    // Open user menu and click Log Out. The Radix dropdown's close-on-window-blur
+    // behavior (added in @radix-ui/react-menu ≥2.1.17) is neutralized globally in
+    // cypress/support/e2e.ts so the menu stays open in headless runs.
     cy.get('[data-e2e="user-menu-trigger"]').click();
     cy.get('[data-e2e="user-menu-logout"]').click();
 

cypress/e2e/smoke/auth.cy.ts

@@ -2,6 +2,27 @@ import { paths } from '@/utils/config/paths.config';
 import { getPathWithParams } from '@/utils/helpers/path.helper';
 import '@testing-library/cypress/add-commands';
 
+/**
+ * Neutralize Radix UI's "close on window blur" behavior in the test runner.
+ *
+ * `@radix-ui/react-menu` ≥2.1.17 (pulled in by `@datum-cloud/datum-ui` 1.3.0)
+ * registers `window.addEventListener('blur', () => close())` whenever a
+ * DropdownMenu / Select / Popover is open. In Cypress headless runs the
+ * application-under-test window routinely lacks OS focus, so the browser fires
+ * spurious `blur` events that close menus the instant they open — making it
+ * impossible to click an item inside (e.g. the user-menu "Log Out"). The
+ * user-visible symptom is `[data-e2e="user-menu-logout"]` "never found".
+ *
+ * We register a `blur` listener on the AUT window at page-load time — before
+ * React/Radix mount — and call `stopImmediatePropagation()`. Because `blur`
+ * targets `window` itself (AT_TARGET phase), listeners run in registration
+ * order, so ours runs before Radix's and prevents the close. This only affects
+ * the test environment; production close-on-blur behavior is untouched.
+ */
+Cypress.on('window:before:load', (win) => {
+  win.addEventListener('blur', (event) => event.stopImmediatePropagation(), { capture: true });
+});
+
 /**
  * Stub the "ambient" authenticated-page polling that fires on every visit so
  * the e2e suite doesn't trip the upstream IAM rate limiter for the test

cypress/support/e2e.ts

@@ -29,76 +29,76 @@
     "test:coverage": "bun test --coverage"
   },
   "dependencies": {
-    "@ai-sdk/anthropic": "^3.0.71",
-    "@ai-sdk/react": "^3.0.170",
-    "@conform-to/react": "1.19.3",
-    "@conform-to/zod": "1.19.3",
-    "@datum-cloud/activity-ui": "^0.5.0",
-    "@datum-cloud/datum-ui": "^1.2.0",
+    "@ai-sdk/anthropic": "^3.0.85",
+    "@ai-sdk/react": "^3.0.210",
+    "@conform-to/react": "^1.19.4",
+    "@conform-to/zod": "^1.19.4",
+    "@datum-cloud/activity-ui": "^0.5.1",
+    "@datum-cloud/datum-ui": "^1.3.0",
     "@epic-web/client-hints": "^1.3.9",
-    "@gqlts/runtime": "^3.3.0",
+    "@gqlts/runtime": "^3.4.2",
     "@hono/prometheus": "^1.0.3",
     "@monaco-editor/react": "^4.7.0",
-    "@openfeature/server-sdk": "^1.21.0",
-    "@opentelemetry/auto-instrumentations-node": "^0.76.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
-    "@opentelemetry/sdk-node": "^0.218.0",
-    "@opentelemetry/sdk-trace-base": "^2.7.0",
-    "@react-router/node": "^7.16.0",
-    "@react-router/serve": "^7.16.0",
-    "@sentry/react-router": "^10.49.0",
-    "@stepperize/react": "^6.1.0",
+    "@openfeature/server-sdk": "^1.22.0",
+    "@opentelemetry/auto-instrumentations-node": "^0.77.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.219.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.219.0",
+    "@opentelemetry/sdk-node": "^0.219.0",
+    "@opentelemetry/sdk-trace-base": "^2.8.0",
+    "@react-router/node": "^7.18.0",
+    "@react-router/serve": "^7.18.0",
+    "@sentry/react-router": "^10.59.0",
+    "@stepperize/react": "^7",
     "@streamdown/code": "^1.1.1",
-    "@stripe/react-stripe-js": "^6.4.0",
-    "@stripe/stripe-js": "^9.6.0",
-    "@tailwindcss/typography": "^0.5.19",
-    "@tailwindcss/vite": "^4.2.2",
-    "@tanstack/react-query": "^5.99.2",
+    "@stripe/react-stripe-js": "^6.6.0",
+    "@stripe/stripe-js": "^9.8.0",
+    "@tailwindcss/typography": "^0.5.20",
+    "@tailwindcss/vite": "^4.3.1",
+    "@tanstack/react-query": "^5.101.0",
     "@tanstack/react-table": "^8.21.3",
-    "@tanstack/react-virtual": "^3.13.24",
-    "@tiptap/extension-character-count": "^3.22.4",
-    "@tiptap/extension-link": "^3.22.4",
-    "@tiptap/extension-placeholder": "^3.22.4",
-    "@tiptap/extension-underline": "^3.22.4",
-    "@tiptap/pm": "^3.22.4",
-    "@tiptap/react": "^3.22.4",
-    "@tiptap/starter-kit": "^3.22.4",
-    "@urql/core": "^6.0.1",
+    "@tanstack/react-virtual": "^3.14.3",
+    "@tiptap/extension-character-count": "^3.27.1",
+    "@tiptap/extension-link": "^3.27.1",
+    "@tiptap/extension-placeholder": "^3.27.1",
+    "@tiptap/extension-underline": "^3.27.1",
+    "@tiptap/pm": "^3.27.1",
+    "@tiptap/react": "^3.27.1",
+    "@tiptap/starter-kit": "^3.27.1",
+    "@urql/core": "^6.0.2",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
-    "ai": "^6.0.168",
-    "axios": "1.16.1",
+    "ai": "^6.0.208",
+    "axios": "^1.18.0",
     "bun": "1.3.14",
     "class-variance-authority": "^0.7.1",
     "d3-geo": "^3.1.1",
-    "date-fns": "^4.1.0",
+    "date-fns": "^4.4.0",
     "date-fns-tz": "^3.2.0",
     "dotenv": "^17.4.2",
-    "es-toolkit": "^1.45.1",
+    "es-toolkit": "^1.48.1",
     "fathom-client": "^3.7.2",
-    "graphql": "^16.13.2",
-    "hono": "^4.12.14",
+    "graphql": "^16.14.2",
+    "hono": "^4.12.26",
     "hono-rate-limiter": "^0.5.3",
     "i18n-iso-countries": "^7.14.0",
-    "ioredis": "^5.10.1",
-    "isbot": "^5.1.39",
-    "isomorphic-dompurify": "^3.9.0",
-    "js-yaml": "^4.1.1",
+    "ioredis": "^5.11.1",
+    "isbot": "^5.1.43",
+    "isomorphic-dompurify": "^3.18.0",
+    "js-yaml": "^5",
     "jwt-decode": "^4.0.0",
-    "lucide-react": "^1.8.0",
+    "lucide-react": "^1.21.0",
     "monaco-editor": "^0.55.1",
-    "motion": "^12.38.0",
+    "motion": "^12.40.0",
     "nprogress": "^0.2.0",
     "nuqs": "^2.8.9",
     "prom-client": "^15.1.3",
     "rate-limit-redis": "^5.0.0",
-    "react": "^19.2.5",
-    "react-day-picker": "^9.14.0",
-    "react-dom": "^19.2.5",
+    "react": "^19.2.7",
+    "react-day-picker": "^10",
+    "react-dom": "^19.2.7",
     "react-dropzone": "^15.0.0",
-    "react-router": "^7.16.0",
-    "react-router-hono-server": "^2.25.3",
+    "react-router": "^7.18.0",
+    "react-router-hono-server": "^2.26.0",
     "recharts": "^3.8.1",
     "remix-auth": "^4.2.0",
     "remix-auth-oauth2": "^3.4.1",
@@ -108,18 +108,18 @@
     "tailwind-scrollbar-hide": "^4.0.0",
     "tailwindcss-animate": "^1.0.7",
     "tslib": "^2.8.1",
-    "urql": "^5.0.2",
+    "urql": "^5.0.3",
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@eslint/compat": "^2.0.5",
-    "@gqlts/cli": "^3.3.0",
-    "@hey-api/openapi-ts": "^0.97.0",
-    "@inquirer/prompts": "^8.4.2",
-    "@react-router/dev": "^7.16.0",
-    "@testing-library/cypress": "^10.1.0",
+    "@eslint/compat": "^2.1.0",
+    "@gqlts/cli": "^3.4.2",
+    "@hey-api/openapi-ts": "^0.99.0",
+    "@inquirer/prompts": "^8.5.2",
+    "@react-router/dev": "^7.18.0",
+    "@testing-library/cypress": "^10.1.3",
     "@trivago/prettier-plugin-sort-imports": "^6.0.2",
-    "@types/axios-curlirize": "^1.3.5",
+    "@types/axios-curlirize": "^1.3.6",
     "@types/compression": "^1.8.1",
     "@types/d3-geo": "^3.1.0",
     "@types/geojson": "^7946.0.16",
@@ -129,42 +129,42 @@
     "@types/leaflet-draw": "^1.0.13",
     "@types/leaflet.markercluster": "^1.5.6",
     "@types/morgan": "^1.9.10",
-    "@types/node": "^25.6.0",
+    "@types/node": "^26",
     "@types/nprogress": "^0.2.3",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@types/topojson-client": "^3.1.5",
     "@types/topojson-specification": "^1.0.5",
-    "@typescript-eslint/eslint-plugin": "^8.59.1",
-    "@typescript-eslint/parser": "^8.59.1",
-    "@vitejs/plugin-react": "^5.1.4",
-    "bun-types": "^1.3.13",
-    "cypress": "^15.14.0",
-    "cypress-split": "^1.24.31",
-    "cypress-vite": "^1.8.0",
-    "eslint": "^10.2.1",
+    "@typescript-eslint/eslint-plugin": "^8.61.1",
+    "@typescript-eslint/parser": "^8.61.1",
+    "@vitejs/plugin-react": "^5.2.0",
+    "bun-types": "^1.3.14",
+    "cypress": "^15.17.0",
+    "cypress-split": "^1.25.0",
+    "cypress-vite": "1.10.0",
+    "eslint": "^10.5.0",
     "eslint-plugin-jsx-a11y": "^6.10.2",
-    "eslint-plugin-prettier": "^5.5.5",
+    "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-unused-imports": "^4.4.1",
-    "lefthook": "^2.1.6",
-    "prettier": "^3.8.3",
+    "lefthook": "^2.1.9",
+    "prettier": "^3.8.4",
     "prettier-plugin-tailwindcss": "^0.8.0",
-    "start-server-and-test": "^3.0.2",
+    "start-server-and-test": "^3.0.11",
     "tailwind-variants": "^3.2.2",
-    "tailwindcss": "^4.2.2",
+    "tailwindcss": "^4.3.1",
     "tw-animate-css": "^1.4.0",
-    "typescript": "^6.0.0",
-    "typescript-eslint": "^8.59.1",
-    "vite": "^7.3.1",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.61.1",
+    "vite": "^7.3.5",
     "vite-tsconfig-paths": "^6.1.1"
   },
   "engines": {
     "node": ">=24.0.0"
   },
   "overrides": {
-    "axios": "^1.15.0",
+    "axios": "^1.18.0",
     "form-data": "^4.0.4",
     "dompurify": "^3.3.2",
     "@hono/node-server": "^2.0.0",