fix(deps): pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
@anatine/esbuild-decorators (source)	dependencies	pin	^0.2.19 → 0.2.19
@dagrejs/dagre	dependencies	pin	^1.1.8 → 1.1.8
@oclif/core	dependencies	pin	^3.27.0 → 3.27.0
@oclif/plugin-help	dependencies	pin	^6.2.36 → 6.2.36
@oclif/plugin-plugins	dependencies	pin	^5.4.54 → 5.4.54
chalk	dependencies	pin	^5.6.2 → 5.6.2
chokidar	dependencies	pin	^3.6.0 → 3.6.0
class-variance-authority	dependencies	pin	^0.7.1 → 0.7.1
clsx	dependencies	pin	^2.1.1 → 2.1.1
commander	dependencies	pin	^11.1.0 → 11.1.0
dagre	dependencies	pin	^0.8.5 → 0.8.5
esbuild-plugin-pino	dependencies	pin	^2.3.3 → 2.3.3
eslint (source)	dependencies	pin	^8.57.1 → 8.57.1
espree (source)	dependencies	pin	^9.6.1 → 9.6.1
express (source)	dependencies	pin	^4.22.1 → 4.22.1
glob	dependencies	pin	^10.5.0 → 10.5.0
handlebars (source)	dependencies	pin	^4.7.8 → 4.7.8
handlebars-utils	dependencies	pin	^1.0.6 → 1.0.6
hasha	dependencies	pin	^6.0.0 → 6.0.0
html-to-image	dependencies	pin	^1.11.13 → 1.11.13
http-proxy-agent (source)	dependencies	pin	^7.0.2 → 7.0.2
https-proxy-agent (source)	dependencies	pin	^7.0.6 → 7.0.6
jotai	dependencies	pin	^2.16.0 → 2.16.0
langium (source)	dependencies	pin	^2.1.3 → 2.1.3
node-fetch	dependencies	pin	^3.3.2 → 3.3.2
p-retry	dependencies	pin	^6.2.1 → 6.2.1
pino-pretty	dependencies	pin	^10.3.1 → 10.3.1
prettier (source)	dependencies	pin	^3.7.4 → 3.7.4
react-error-boundary (source)	dependencies	pin	^4.1.2 → 4.1.2
reactflow (source)	dependencies	pin	^11.11.4 → 11.11.4
tailwind-merge	dependencies	pin	^2.6.0 → 2.6.0
tempy	dependencies	pin	^3.1.0 → 3.1.0
tokio-stream (source)	dependencies	pin	0.1.15 → =0.1.15
tokio-util (source)	dependencies	pin	0.7.10 → =0.7.10
tonic	dependencies	pin	0.11.0 → =0.11.0
tonic-health	dependencies	pin	0.11.0 → =0.11.0
tonic-types	dependencies	pin	0.11.0 → =0.11.0
tonic-web	dependencies	pin	0.11.0 → =0.11.0
tower-http	dependencies	pin	0.5.2 → =0.5.2
tower-lsp-macros	dependencies	pin	0.9.0 → =0.9.0
tracing (source)	dependencies	pin	0.1.40 → =0.1.40
ts-morph	dependencies	pin	^20.0.0 → 20.0.0
ts-pattern	dependencies	pin	^5.9.0 → 5.9.0
vscode	dependencies	pin	^1.1.37 → 1.1.37
vscode-languageclient (source)	dependencies	pin	^9.0.1 → 9.0.1
vscode-languageserver (source)	dependencies	pin	^9.0.1 → 9.0.1
vscode-languageserver-textdocument (source)	dependencies	pin	^1.0.12 → 1.0.12
vscode-uri	dependencies	pin	^3.1.0 → 3.1.0
zod (source)	dependencies	pin	^3.25.76 → 3.25.76
zod-validation-error	dependencies	pin	^2.1.0 → 2.1.0

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path apps/engine/Cargo.toml --package tokio-stream@0.1.15 --precise 0.1.15
error: failed to load manifest for workspace member `/tmp/renovate/repos/github/storm-software/acidic/apps/engine`
referenced by workspace at `/tmp/renovate/repos/github/storm-software/acidic/Cargo.toml`

Caused by:
  failed to load manifest for dependency `acidic-config`

Caused by:
  failed to read `/tmp/renovate/repos/github/storm-software/acidic/crates/config/Cargo.toml`

Caused by:
  No such file or directory (os error 2)

[deepsource-io]

Here's the code health analysis summary for commits fb59a67..f299939. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Summary	Link
JavaScript	✅ Success		View Check ↗
Shell	✅ Success		View Check ↗

---

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	class-variance-authority@​0.7.1
	eslint-config-prettier@​9.1.2
	esbuild@​0.24.2
	clsx@​2.1.1
	chokidar@​3.6.0
	html-to-image@​1.11.13
	chalk@​5.6.2
	glob@​10.5.0
	commander@​11.1.0
	node-fetch@​3.3.2
	handlebars@​4.7.8
	prettier@​3.7.4

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm buffer is 96.0% likely obfuscated Confidence: 0.96 Location: Package overview From: pnpm-lock.yaml → npm/buffer@4.9.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/buffer@4.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → npm/entities@4.5.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → npm/entities@6.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm markdown-it is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → npm/markdown-it@14.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/markdown-it@14.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm safer-buffer is 94.0% likely obfuscated Confidence: 0.94 Location: Package overview From: pnpm-lock.yaml → npm/safer-buffer@2.1.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/safer-buffer@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report