chore(deps): resolve all 51 open security advisories (#51)

Bumps the four direct dependencies that account for nearly every open
advisory, and fixes the two CI failures that were blocking the Dependabot
queue from clearing on its own.

Dependencies:
- next 16.2.9 -> 16.3.3, which carries patched postcss (8.5.23) and
  sharp (^0.35.3) upstream
- next-auth 4.24.14 -> 4.24.15, which moves uuid to ^11.1.1
- prisma / @prisma/client / @prisma/adapter-pg 7.8.0 -> 7.10.0.
  @prisma/dev replaced hono with find-my-way, so hono and
  @hono/node-server leave the tree entirely
- eslint-config-next tracks next

Resolutions were rewritten from unbounded `>=` ranges to bounded caret
ranges. An unbounded range resolves to whatever is newest at install
time, so `js-yaml: ">=3.14.2"` would have pulled the ESM-only js-yaml 5
into ESLint on the next clean install; only the lockfile was holding it
back.

CI, which is why the backlog accumulated:
- The dev-dependencies Dependabot group had no update-types restriction,
  so majors were batched with safe updates and failed the whole group.
  Now restricted to minor/patch, matching the production group.
- dependency-review lacked pull-requests: write, so licence failures
  reported "incompatible licenses" without naming the package. With the
  summary visible, the offenders are elkjs (EPL-2.0) and
  robust-predicates (LicenseRef-scancode-public-domain AND Unlicense,
  where the LicenseRef- half is not an SPDX identifier), both exempted
  per-package, plus LGPL-3.0-or-later for sharp's libvips binaries.

All checks green: type-check, lint, test, build, e2e, dependency-review
(0 vulnerable packages) and the Vercel preview deploy.

Author: christopherrobin

.github/dependabot.yml

@@ -7,8 +7,16 @@ updates:
       day: 'monday'
     open-pull-requests-limit: 5
     groups:
+      # Restricted to minor/patch for the same reason as the production
+      # group: an unrestricted group sweeps majors in, and one breaking
+      # major fails CI for the whole batch, so none of the other updates
+      # can land. Majors still arrive, as individual PRs that can be
+      # evaluated on their own.
       dev-dependencies:
         dependency-type: 'development'
+        update-types:
+          - 'minor'
+          - 'patch'
       production-dependencies:
         dependency-type: 'production'
         update-types:

.github/workflows/ci.yml

@@ -26,8 +26,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: '.nvmrc'
           cache: 'yarn'
@@ -39,8 +39,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: '.nvmrc'
           cache: 'yarn'
@@ -52,8 +52,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: '.nvmrc'
           cache: 'yarn'
@@ -65,8 +65,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: '.nvmrc'
           cache: 'yarn'
@@ -95,8 +95,8 @@ jobs:
       DATABASE_PUBLIC_URL: postgresql://ci:ci@localhost:5432/ci
       DATABASE_TEST_URL: postgresql://ci:ci@localhost:5432/ci
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: '.nvmrc'
           cache: 'yarn'
@@ -124,8 +124,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     timeout-minutes: 5
+    # Overrides the workflow-level `contents: read` for this job only.
+    # Without pull-requests: write the action cannot post its summary,
+    # so a licence failure reports "incompatible licenses" and never
+    # names the package responsible.
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: moderate
@@ -135,4 +142,22 @@ jobs:
           fail-on-scopes: runtime
           comment-summary-in-pr: on-failure
           license-check: true
-          allow-licenses: MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, Unlicense, BlueOak-1.0.0, MPL-2.0
+          # LGPL-3.0-or-later covers the ten @img/sharp-libvips-* native
+          # binaries that ship with sharp, which Next pulls in for image
+          # optimisation. They are prebuilt, dynamically linked, already
+          # present on main, and re-evaluated here only because sharp
+          # changed version. Adding it also clears the sharp win32 and
+          # wasm32 packages, which declare compound expressions like
+          # "Apache-2.0 AND LGPL-3.0-or-later" — a compound expression is
+          # satisfied once every component it names is allowed.
+          allow-licenses: MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, Unlicense, BlueOak-1.0.0, MPL-2.0, LGPL-3.0-or-later
+          # Two packages cannot be cleared by licence name, so they are
+          # exempted individually and the policy above stays strict for
+          # everything else. Both arrive via @prisma/studio-core, making
+          # them CLI tooling that never enters the application bundle.
+          #
+          # elkjs is EPL-2.0. robust-predicates declares
+          # "LicenseRef-scancode-public-domain AND Unlicense"; the
+          # LicenseRef- half is not an SPDX identifier, so allowing
+          # Unlicense does not satisfy the expression.
+          allow-dependencies-licenses: 'pkg:npm/elkjs, pkg:npm/robust-predicates'

package.json

@@ -32,13 +32,13 @@
     "@mui/icons-material": "^9.1.1",
     "@mui/material": "^9.1.1",
     "@mui/material-nextjs": "^9.1.1",
-    "@prisma/adapter-pg": "^7.8.0",
-    "@prisma/client": "^7.8.0",
+    "@prisma/adapter-pg": "^7.10.0",
+    "@prisma/client": "^7.10.0",
     "bcryptjs": "^3.0.3",
-    "next": "16.2.9",
-    "next-auth": "^4.24.14",
+    "next": "16.3.3",
+    "next-auth": "^4.24.15",
     "pg": "^8.21.0",
-    "prisma": "^7.8.0",
+    "prisma": "^7.10.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-hook-form": "^7.79.0",
@@ -62,7 +62,7 @@
     "@typescript-eslint/parser": "^8.61.0",
     "dotenv-cli": "^11.0.0",
     "eslint": "^9.39.4",
-    "eslint-config-next": "16.2.9",
+    "eslint-config-next": "16.3.3",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-import-x": "^4.16.2",
     "eslint-plugin-prettier": "^5.5.6",
@@ -98,14 +98,17 @@
     "node": ">=24.0.0"
   },
   "resolutions": {
-    "@hono/node-server": ">=1.19.13",
-    "diff": ">=4.0.4",
-    "flatted": ">=3.4.2",
-    "js-yaml": ">=3.14.2",
-    "minimatch": ">=3.1.3",
-    "picomatch": ">=4.0.4",
-    "postcss": ">=8.5.10",
-    "preact": ">=10.26.10",
-    "yaml": ">=1.10.3"
+    "brace-expansion": "^5.0.9",
+    "deepmerge-ts": "^8.0.2",
+    "diff": "^9.0.0",
+    "fast-uri": "^3.1.5",
+    "flatted": "^3.4.2",
+    "js-yaml": "^4.3.1",
+    "minimatch": "^10.2.5",
+    "nanoid": "^3.3.18",
+    "picomatch": "^4.0.4",
+    "postcss": "^8.5.23",
+    "preact": "^10.29.1",
+    "yaml": "^2.8.4"
   }
 }