chore(deps): consolidated Dependabot batch 2026-08-10

[Weegy]

Consolidates the 2026-08-10 Dependabot run into a single reviewable, verified change so the individual bot PRs can be closed without merging nine separate lockfile churns.

What's in

Workspace	Package	main	This PR	Dependabot proposed
middleware	@azure/msal-node	^5.3.1	^5.5.0	5.5.0
middleware	typescript-eslint	^8.60.1	^8.66.0	8.66.0
middleware	ws	^8.21.1	^8.21.3	8.21.2
middleware	@types/pg (dev)	^8.11.10	^8.21.0	8.20.4
middleware	tsx (dev)	^4.23.1	^4.23.12	4.23.10
middleware/packages/harness-orchestrator	csv-parse	^7.0.1	^7.0.2	7.0.2
web-ui	next	^16.2.12	^16.3.0	16.3.0
web-ui	next-intl	^4.13.2	^4.13.5	4.13.5
web-ui	framer-motion	^12.42.2	^13.0.0	13.0.0
web-ui	lucide-react	^1.17.0	^1.31.0	1.29.0
web-ui	eslint-config-next (dev)	^16.2.12	^16.3.0	16.3.0
web-ui	@testing-library/user-event (dev)	^14.6.1	^14.6.3	14.6.3

Four packages resolve higher than the bot proposed (ws, @types/pg, tsx, lucide-react) — Dependabot proposals go stale within hours of the Monday run, so this takes the current resolution instead.

tsx and ws are also mirrored into the workspace manifests that declare them
(packages/canvas-core, packages/dev-runner-shim) so the ranges stay consistent.

The one major: framer-motion 13

The single breaking change in 13.0.0 is the removal of the automatic
@emotion/is-prop-valid prop-validation loading, now opt-in via
<MotionConfig isValidProp={...}>.

This is inert here: @emotion/is-prop-valid is not in the dependency tree
before or after the bump, and MotionConfig/isValidProp appear nowhere in
the repo.

Worth flagging separately — framer-motion currently has zero import sites on
main. The Lume migration removed the last consumer but left the dependency
declared. It is deliberately not removed in this PR, because three open PRs
(#264, #271, #471) still import it and would break on merge. Once those land or
drop their usage, framer-motion should be dropped from web-ui/package.json
entirely rather than bumped again.

dependabot.yml — closing a recurring gap

The typescript major-version ignore existed only in the /web-ui block. The
/middleware block lacked it, so the bot re-raised a TypeScript 7 bump against
middleware every Monday (PR #595, which died at npm ci because
typescript-eslint's peer range caps at <6.1.0). This PR mirrors the ignore
into the middleware block.

Verification

Run locally on Node 22.22.3, mirroring the CI job order (npm ci → build → lint
→ typecheck → test):

Check	middleware	web-ui
npm ci	pass	pass
build	pass	pass (Next 16.3.0)
lint	0 errors	0 errors (44 pre-existing warnings)
typecheck	pass	pass
test	6094 pass / 0 fail / 4 skipped (1269 suites)	657 pass / 0 fail (79 files)
npm run i18n:check	n/a	pass
npm audit --audit-level=high	0 high, 0 critical	0 high, 0 critical

The audit gate blocks on high+critical and runs without --omit=dev; both
workspaces clear it. Remaining moderates are pre-existing and unrelated to this
batch (dompurify via monaco-editor in web-ui; uuid via exceljs and
botframework-streaming in middleware).

Superseded — safe to close

Fully contained in this PR: #628, #629, #630, #631, #632, #633, #634, #635, #636

Excluded

• chore(deps,middleware)(deps): bump better-sqlite3 from 12.11.1 to 13.0.3 in /middleware #637 better-sqlite3 12.11.1 → 13.0.3 — not a plain version bump. v13
  removed the install hook, so with binding.gyp present npm compiles from
  source and the node:*-slim image has no Python toolchain. That work already
  exists as chore(deps,middleware): bump better-sqlite3 to 13.0.3 (N-API) #615, which carries the Docker builder fix alongside the bump.
  Close chore(deps,middleware)(deps): bump better-sqlite3 from 12.11.1 to 13.0.3 in /middleware #637 as a duplicate of chore(deps,middleware): bump better-sqlite3 to 13.0.3 (N-API) #615 and merge chore(deps,middleware): bump better-sqlite3 to 13.0.3 (N-API) #615 on its own.

Recommended follow-ups

1. Drop the dead framer-motion dependency once feat(agent-builder): editable visual canvas for channels/sub-agents/skills/tools/MCP/schedules #264/fix(operator-agents): redesign plugin DnD for visibility + fix host-list overflow #271/One-click deploy (Render + Fly.io) — and the four first-run fixes it surfaced #471 are resolved.
2. The docker ecosystem in dependabot.yml still covers only / and /web-ui;
   middleware/sidecars/dev-runner/Dockerfile and
   .../dev-runner-daemon/Dockerfile remain unmanaged and will keep drifting.
3. The middleware lockfile still lags its declared ranges. A deliberate,
   separately-reviewed full regen is a standing item — it moves ~75 packages
   including a transitive @hono/node-server major, so it must not ride along
   in a routine batch.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}