chore(PP-3449): update dependencies to latest

[sergak01]

Summary

Updates dependencies to latest across the root package and all three test fixtures (test-nextjs, test-nextjs-cjs, test-commonjs), including several major-version bumps, with a handful of deliberate exceptions where the ecosystem/runtime isn't ready yet.

Key changes

• 🔧 Root: http-proxy-middleware 3→4, ejs 5→6, @types/node 25→26, plus routine minor/patch bumps (next, vite, vitest, rollup, sass, prettier, axios, sharp, eslint, semantic-release, @playwright/test, etc.)
• 🔧 test-nextjs: same http-proxy-middleware/ejs/@types/node majors, plus next/react/react-dom/tailwindcss/sass/rollup patch bumps
• 🔧 test-nextjs-cjs: @types/node 25→26, next/react/react-dom/tailwindcss/sharp patch bumps
• 🔧 test-commonjs: vite patch bump, @types/luxon patch bump

Intentionally NOT bumped (verified, not overlooked)

• undici stays on latest 7.x (not 8.x) — the root/test-nextjs overrides force a single undici resolution repo-wide, and jsdom pins ^7.25.0 and reaches into undici's internal file layout (require('undici/lib/handler/wrap-handler.js')), which v8 restructured. Bumping broke jsdom at runtime (Cannot find module 'undici/lib/handler/wrap-handler.js') — reproduced and confirmed before reverting.
• eslint stays on latest 9.x (not 10.x) in test-nextjs/test-nextjs-cjs — eslint-config-next@16.2.10's peer dependency only allows eslint@^3...^9; installing 10.x only succeeds via forced ERESOLVE overrides, which is unsafe for a config package whose plugins may not actually support the new major.
• jquery/@types/jquery stay on latest 3.x (not 4.x) in test-commonjs — this fixture mirrors a real Portal Page template, and the MI backend that serves /js/jquery/jquery-latest.min.js in production still serves jQuery 3, so the fixture needs to match runtime reality rather than the npm registry's latest.

Pre-existing issues found during verification (unrelated to this bump, confirmed via git stash on original deps)

• next lint no longer exists as a CLI command in Next.js 16 (removed upstream) — not exercised by CI, not caused by this PR.
• test-nextjs/test-nextjs-cjs local next build can fail type-checking due to a stray empty lockfile at C:\Users\<user>\repos\package-lock.json confusing Turbopack's workspace-root inference on this machine, and separately due to stale untracked dist/dev/types/validator.ts colliding with fresh .next/types/validator.ts. Both are local-environment artifacts (gitignored dirs / sibling-repo lockfile), not present in a clean CI checkout.
• test-nextjs-cjs's tailwind.config.ts fails tsc type resolution under its moduleResolution: "node" setting against Tailwind v4's .d.mts-only export map — reproduced identically on the original, unbumped tailwindcss@4.2.2, so this is pre-existing and out of scope here.

Testing

• npm run audit:all — 0 vulnerabilities across root + all 3 fixtures
• npx tsc --noEmit (root) — clean
• npm run lint (root) — clean
• npm run test:unit — 185 passed
• npm run test:integration — 39 passed
• npm run build (root + all 3 fixtures) — all succeed

Merge Request: origin/pp-3449-deps-update → origin/develop

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ded4f581-ddcf-4aa7-bdd2-b9d1dfdb3bb0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pp-3449-deps-update

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}