chore(deps): consolidate 23 open Dependabot PRs (#239-267)

[pacphi]

Summary

Consolidates all 23 open Dependabot PRs into one branch/PR, applying each bump as
latest-compatible within its existing major, regenerating lockfiles once (not per-PR),
and fixing every failure surfaced along the way — both upgrade-caused and pre-existing.
PR #262 (the develop → main postgres-support feature integration) is out of scope
and untouched.

Superseded PRs

#	Package	Bump	Area
#267	taiki-e/install-action	2.85.5 → 2.86.5	CI (GitHub Actions)
#265	DavidAnson/markdownlint-cli2-action	24.1.0 → 24.2.0	CI (GitHub Actions)
#263	nanoid (transitive, via postcss)	3.3.16 → 6.0.1*	frontend
#250	nanoid (direct)	5.1.16 → 6.0.1*	frontend
#258	framer-motion	12.40.0 → 12.43.0	frontend
#257	postcss (dev)	8.5.18 → 8.5.25	frontend
#256	idb-keyval	6.2.5 → 6.3.0	frontend
#255	react-dom + @types/react-dom	19.2.7 → 19.2.8 / 19.2.3 → 19.2.4	frontend
#254	react + @types/react	19.2.7 → 19.2.8 / 19.2.17 → 19.2.18	frontend
#253	node-llama-cpp	3.18.1 → 3.19.1	frontend
#252	@vitejs/plugin-react (dev)	6.0.2 → 6.0.5	frontend
#251	jsdom (dev)	29.1.1 → 30.0.1	frontend
#249	react-hook-form	7.79.0 → 7.84.0	frontend
#248	mail-parser	0.11.4 → 0.11.8	backend (Cargo)
#247	base64	0.22.1 → 0.23.1	backend (Cargo)
#246	thiserror (+syn group)	2.0.18 → 2.0.20	backend (Cargo)
#245	regex	1.12.4 → 1.13.1	backend (Cargo)
#244	redis	1.3.0 → 1.6.0	backend (Cargo)
#243	futures	0.3.32 → 0.3.33	backend (Cargo)
#242	fastembed	5.17.2 → 5.17.4	backend (Cargo)
#241	anyhow	1.0.103 → 1.0.104	backend (Cargo)
#240	serde group (serde, serde_json)	1.0.228 → 1.0.229 / 1.0.150 → 1.0.151	backend (Cargo)
#239	tokio group (tokio, tokio-stream, tokio-util)	1.52.3 → 1.53.1 / 0.1.18 → 0.1.19 / 0.7.18 → 0.7.19	backend (Cargo)

* #263 and #250 both target nanoid: #263 bumped a transitive resolution (via postcss),
#250 bumped the direct apps/web dependency. Both are superseded by bumping the direct
dependency to ^6.0.1 (latest); the transitive instance resolves independently through
the postcss bump and a pnpm-workspace.yaml override (see Security audit below). The
only direct source usage (ComposeEmail.tsx, plain nanoid()) is unaffected by the v5→v6
API, and its test still passes.

base64 (#247) and nanoid (direct, via #250/#263) were the only bumps requiring a
manifest edit — base64 0.22 → 0.23 crosses a Cargo 0.x "major", and nanoid crosses
an npm major. Every other backend crate's caret range already permitted the newer
version, so only Cargo.lock moved (in several cases beyond the PR's originally
proposed version, since cargo update -p <crate> picks the current latest-compatible —
e.g. mail-parser 0.11.8 not 0.11.5, redis 1.6.0 not 1.5.0, thiserror 2.0.20 not 2.0.19).

Pre-existing fixes

None of the upgrades broke fmt/clippy/tests/typecheck/lint/build — the full gate was
already green on main before this branch. No pre-existing breakage to fix.

Security audit

Ran cargo audit (via .github/scripts/cargo-audit.sh, honoring backend/audit-ignore),
pnpm audit, and pulled the repo's open Dependabot alerts.

cargo audit — 4 findings not covered by any open dependency PR, all fixed by bumping
the lockfile (no Cargo.toml/manifest changes, no submodule edits):

Advisory	Crate	Was → Now	Note
RUSTSEC-2026-0258	h2	0.4.14 → 0.4.16	unbounded empty DATA frames; transitive via hyper
RUSTSEC-2026-0233	rkyv	0.8.16 → 0.8.17	UAF during deserialization of crafted archives
RUSTSEC-2026-0234	rkyv	0.8.16 → 0.8.17	OOB read via insufficient hash-table validation
RUSTSEC-2026-0235	rkyv	0.8.16 → 0.8.17	OOB read via insufficient Rc/Arc validation

rkyv is pulled in by the vendored ruvector submodule (ruvector-core/ruvector-gnn);
its own Cargo.toml range already permitted 0.8.17, so this is a lockfile-only fix with
no submodule edit. Re-ran cargo audit after: 0 vulnerabilities.

pnpm audit — 4 findings, all pre-existing (unrelated to the packages any open PR
touched) and traced to two outdated security-override pins already in
frontend/pnpm-workspace.yaml (added for earlier advisories, since superseded by newer
ones on the same packages):

Advisory	Package	Was pinned → Now pinned	Note
GHSA-fxqj-rqcc-2cmp	postcss (transitive)	<8.5.18→8.5.18 → <8.5.23→8.5.25	incomplete fix of an earlier sourceMappingURL path-traversal advisory; pin superseded
GHSA-2v37-7h3g-55p8	nanoid (transitive, via postcss)	none → <3.3.18→3.3.18	custom generators loop indefinitely when size is 0
GHSA-rgw5-rvv9-x895	brace-expansion (1.x line)	<1.1.17→1.1.17 → <1.1.18→1.1.18	bypasses the CVE-2026-14257 mitigation the 1.1.17 pin was for
GHSA-rgw5-rvv9-x895	brace-expansion (4.x/5.x line)	<5.0.8→5.0.8	<5.0.9→5.0.9

Re-ran pnpm audit --audit-level moderate after: no known vulnerabilities found.

GitHub Dependabot alerts (gh api .../dependabot/alerts) — 9 open at branch-creation
time. Two (nanoid GHSA-2v37-7h3g-55p8, postcss GHSA-fxqj-rqcc-2cmp) match the pnpm
audit findings above and are fixed by the same override bumps. The remaining seven
(nanoid GHSA-28wg-ghj8-5hjv range <5.1.16, and five undici alerts range <7.29.0,
plus brace-expansion GHSA-rgw5-rvv9-x895) already resolve to safe versions on this
branch as a side effect of the jsdom/react-hook-form bumps pulling in undici@8.10.0
and the direct nanoid bump to 6.0.1 — confirmed via pnpm why. GitHub will close
those automatically once it rescans the new lockfile; no separate action needed.

Verification

All commands run from a clean checkout of this branch.

Backend (mirrors .github/workflows/ci.yml):

$ cd backend && cargo fmt --package emailibrium -- --check
(clean)

$ cargo clippy --workspace --all-targets -- -D warnings -A dead_code -A unused_variables -A unused_imports -A unused_mut
Finished `dev` profile [unoptimized + debuginfo] target(s) in 48.77s

$ cargo test --workspace
15 test binaries, 0 failed (exit 0)

$ cargo bench --no-run
Finished `bench` profile [optimized] target(s) — 3 executables built

$ bash .github/scripts/cargo-audit.sh --no-fetch
Scanning Cargo.lock for vulnerabilities (702 crate dependencies) — 0 found

Frontend (mirrors .github/workflows/ci.yml):

$ cd frontend && pnpm install --frozen-lockfile
Lockfile is up to date, resolution step is skipped

$ cd apps/web && npx tsc --noEmit
(clean)

$ npx prettier --check 'src/**/*.{ts,tsx}'
All matched files use Prettier code style!

$ npx eslint src/
(clean)

$ cd frontend && pnpm turbo test
23+6+ test files, 398 tests passed across web/core/api

$ pnpm turbo build
✓ built in 275ms

$ pnpm audit --audit-level moderate
No known vulnerabilities found

🤖 Generated with Claude Code

[pacphi]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.