chore(deps): lock file maintenance

[ferrlabs-renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

SonarQube — aucune nouvelle issue

_{Comparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail}

[ferrfleet]

1. What changed — Pure lockFileMaintenance refresh, single file (pnpm-lock.yaml), no package.json ranges touched. All bumps are patch/minor within existing semver: tsx 4.23.11→.12, vite 8.2.0→8.2.1, rolldown 1.2.1→1.2.3, hono 4.12.33→4.13.1, @hono/node-server 2.0.12→2.1.0, jose 6.2.7→6.2.8, nanoid 3.3.16→3.3.18, postcss 8.5.25→8.5.26, ip-address 10.4.0→10.5.0, express-rate-limit 8.6.1→8.6.2, eventsource-parser 3.1.0→3.1.1. No majors, nothing release-note-worthy for this repo.

2. What breaks here — Nothing expected. One diff line looks alarming at first glance: @ferrlabs/mcp-core resolution flips from link:../mcp-core to file:packages/mcp-core(supports-color@7.2.0)(zod@4.4.3) for all four internal importers. That matches injectWorkspacePackages: true, already set in pnpm-workspace.yaml on main — this lockfile refresh is just catching up to existing config, not introducing a new resolution mode. Not a regression.

3. Why CI fails — Test / Test & Build is red on this commit (7af5977); Quality (knip, madge, audit), all Secrets + CVE scans, and Conventional commits are green. I couldn't pull the raw job log for this run (no log-fetch access to this private repo's Actions run from this session), so I can't name the failing step/assertion. Given the diff is lockfile-only with no major bumps, this reads more like a real regression from one of the transitive updates (or a flake) than something to dismiss — worth a manual look at the "Test & Build" run before merging.

Blocking: Test / Test & Build is failing on the head commit — please check the run output (https://github.com/FerrLabs/MCP/actions/runs/31631697343/job/94231784756) and confirm whether it's a real incompatibility from this refresh or a flake before merging.

[ferrfleet]

Follow-up on new commit d34590b — root cause of the CI failure I flagged last time is now confirmed.

1. What changed — Another lockfile-maintenance refresh, same shape as before: patch/minor bumps only (tsx, vite, rolldown, hono, @hono/node-server, jose, nanoid, postcss, ip-address, express-rate-limit, eventsource-parser). No majors, nothing release-note relevant.

2. What breaks here — Confirmed real incompatibility. pnpm-workspace.yaml's injectWorkspacePackages: true (already on main, unrelated to this PR) plus packages/mcp-core/package.json's "files": ["dist"] mean this refreshed lockfile is the first to actually apply that setting: @ferrlabs/mcp-core flips from link:../mcp-core (live symlink) to file:packages/mcp-core(...) (a copy captured at pnpm install time, dist-only).

Root package.json's typecheck script builds mcp-core after install: pnpm --filter @ferrlabs/mcp-core run build && pnpm --filter @ferrlabs/mcp run typecheck && .... That ordering was fine under link: (the symlink always reflects the freshly-built dist). Under file: injection the copy is frozen at install time, and packages/mcp-core/dist doesn't exist yet in a fresh checkout — so consumers get an empty package.

3. Why CI fails — Not a flake. Test / Test & Build fails with ~10 TS errors, headlined by "Cannot find module '@ferrlabs/mcp-core' or its corresponding type declarations," exactly matching the mechanism above.

This isn't fixable in this diff (auto-generated lockfile) and isn't a version-constraint problem — it's a workspace/build-ordering bug in the base repo that this refresh exposes for the first time. Two ways out: (a) set injectWorkspacePackages: false in pnpm-workspace.yaml to keep the symlink resolution the current build-then-typecheck order already relies on, or (b) keep injection on and build mcp-core's dist before pnpm install (e.g. a prepare/postinstall hook, or commit dist). (a) is the smaller, lower-risk change unless something else specifically motivated turning injection on.

Blocking: Test & Build fails for a confirmed, real reason — needs the workspace/build-order fix on main before this (or any future lockfile refresh) can go green.