chore: update packages

[SiebeBaree]

Summary by CodeRabbit

• Chores
  • Updated runtime and dev dependencies (including React, Axios, TypeScript and test/tooling packages) to newer stable versions and tightened override minimums for select transitive packages.
• Build/CI
  • Switched SBOM generation in CI to run via npm exec in a temporary prefix directory.
• Chores
  • Enabled Bun types and added an ignoreDeprecations compiler option in TypeScript config.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2b4648b6-0725-42cb-8504-5f7850761d1b

📥 Commits

Reviewing files that changed from the base of the PR and between 03399a0 and 7009793.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/security.yml
• package.json
• tsconfig.json

✅ Files skipped from review due to trivial changes (1)

• tsconfig.json

🚧 Files skipped from review as they are similar to previous changes (1)

• package.json

---

Walkthrough

Updates project dependencies and devDependencies in package.json (bumping @t3-oss/env-core, axios, ink, posthog-node, react, @types/bun, @types/node, @vitest/coverage-v8, msw, oxfmt, oxlint, typescript, vitest). Replaces the previous overrides (picomatch) with a broader overrides block pinning/minimuming axios, follow-redirects, picomatch, and vite. CI workflow steps that generate SBOM now use npm exec with a temporary prefix directory instead of bunx. tsconfig.json adds "types": ["bun"] and "ignoreDeprecations": "6.0". No exported/public API changes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Development #20 — Also bumps React to a ^19.x version (related dependency version change).

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'chore: update packages' is vague and generic, using the non-descriptive term 'update packages' without specifying which packages or the nature of updates (e.g., security fixes, feature additions, breaking changes).	Consider making the title more specific, such as 'chore: update dependencies to latest versions' or 'chore: update packages and workflows for Node.js compatibility', to better convey the scope and purpose of the changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/update-packages

---

_{Review rate limit: 3/5 reviews remaining, refill in 18 minutes and 44 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 29: The package.json currently depends on "ink": "^7.0.1" but does not
declare a Node engine floor; add an engines.node field to package.json to
explicitly state the minimum supported Node version (e.g., "engines": { "node":
">=22" }) if you intend to require Ink v7, or alternatively downgrade/pin the
dependency (change the "ink" entry to a v6-compatible version) if you must
continue supporting Node 18/20; update package.json accordingly so installs and
CI enforce the correct Node baseline.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0ca8c6a1-3fba-4afe-a6d9-1b8b9df46ffc

📥 Commits

Reviewing files that changed from the base of the PR and between ebe28cd and 830ed89.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• package.json