chore: bump npm dependencies

[claude]

Requested by Łukasz Komoszyński · Slack thread

A full dependency-maintenance pass across the workspace.

Before / After

Before: the repo lints with a legacy CommonJS flat-config (root eslint.base.config.cjs + per-package .cjs/.js files, eslint-plugin-prettier), lint is red on 4 pre-existing errors and excluded from the CI gate, @leancodepl/* tooling is pinned at 9.6.3, code imports zod/v4, and it runs on Nx 21 / Node 22.

After: the repo lints green with the shared @leancodepl/eslint-config flat config (single ESM eslint.config.mjs, matching js_corelibrary), runs on Node 24, imports plain zod (v4), and is on Nx 23 with current tooling. CI is green on Node 24: build (9 projects), test (31 tests / 23 snapshots), and lint (all 10 projects).

What changed

ESLint → flat config (js_corelibrary parity)

• Replaced eslint.base.config.cjs + all per-package eslint.config.cjs/.js with a single root ESM eslint.config.mjs; each package re-exports it via its own eslint.config.mjs (schema keeps its protocol/ ignore).
• Spreads the @nx/eslint-plugin flat presets plus base + imports from @leancodepl/eslint-config (no React presets — this repo generates TS contracts); enforces @nx/enforce-module-boundaries + @nx/dependency-checks; ignores **/dist + **/*.timestamp*.
• Pinned eslint ^9.39.4, unified typescript-eslint 8.62.1 (removed the separate @typescript-eslint/parser + eslint-plugin), eslint-config-prettier 10.1.8; removed eslint-plugin-prettier; prettier reduced to a one-line re-export of @leancodepl/prettier-config.
• Fixed the 4 pre-existing lint failures (perfectionist import ordering, several unicorn/* rules, prettier reformatting); nx.json lint inputs point at the flat config.

@leancodepl/* bumps

• @leancodepl/eslint-config / prettier-config / resolve-eslint-flat-config: 9.6.3 → 10.5.2.
• Runtime @leancodepl/utils (in -schema, -types, -generator): >=7.2.3 → >=10.5.2. 10.x is pure ESM, so a transformIgnorePatterns was added to the shared Jest preset to let ts-jest transpile @leancodepl/* (and tiny-invariant).

zod → 4

• Raised the zod floor to >=4.4.3 across root, generator, and the raw/zod/client/contracts plugins.
• Simplified the five source imports from zod/v4 to plain zod (on >=4.4.3 the root entry already is the v4 API); generated snapshots unchanged.

Other dependency bumps

• Nx: 21.6.4 → 23.0.1 (nx migrate, migrations applied, aligned @swc/*).
• @commitlint/cli + config-conventional → 21; lerna → 9; jsdom → 29.
• protobufjs 7.5.3 → 8.6.6 (+ protobufjs-cli 1.1.3 → 2.5.7; -schema range widened to ^8.0.0).
• @types/node ^24 → ^24.13.2 (latest 24.x, aligned with the Node 24 runtime); yaml 2.8.0 → 2.9.0; lodash floor → ^4.18.1; tslib floor → ^2.8.1; @swc/core → 1.15.43; plus safe minor/patch devDeps (@types/lodash, jest, jest-environment-jsdom, jest-util, jiti, ts-jest, verdaccio).

Node

• .nvmrc 22 → 24.13 (js_corelibrary parity). Both CI workflows resolve via node-version-file: .nvmrc; no engines.node pins to change.

Held / needs a maintainer decision

• typescript 5.9 → 6.0 — held. TS 6 turns baseUrl (TS5101) and moduleResolution: node10 (TS5107) into hard errors; needs a real tsconfig migration, so it belongs in its own PR. TypeScript stays pinned at 5.9.3.
• Protobuf codegen regeneration — deferred to its own PR. protobufjs-cli 2 runs (verified via schema:proto-update), but regenerating the protocol files is ~12k lines of purely stylistic codegen churn; CI stays green on the existing generated files.