chore(deps): aggregate weekly Dependabot batch (api, ui, docs, ci)

.github/workflows/apps-api-acl-drift.yml

@@ -42,7 +42,7 @@ jobs:
         with:
           bun-version: 1.3.14
       - name: Cache bun install
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('apps/api/bun.lock') }}

.github/workflows/apps-api-ci.yml

@@ -95,7 +95,7 @@ jobs:
 
       - name: Cache bun install
         if: steps.filter.outputs.code == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('apps/api/bun.lock') }}

.github/workflows/apps-api-openapi-drift.yml

@@ -94,7 +94,7 @@ jobs:
           bun-version: 1.3.14
       - name: Cache bun install
         if: steps.filter.outputs.code == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('apps/api/bun.lock', 'apps/ui/bun.lock') }}

.github/workflows/apps-docs-linkcheck.yml

@@ -88,7 +88,7 @@ jobs:
           bun-version: 1.3.14
       - name: Cache bun install
         if: steps.filter.outputs.docs == 'true' || steps.filter.outputs.catalog == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('apps/docs/bun.lock', 'apps/ui/bun.lock', 'apps/api/bun.lock') }}

.github/workflows/apps-ui-bundle-diff.yml

@@ -62,7 +62,7 @@ jobs:
           bun-version: 1.3.14
       - name: Cache bun install
         if: steps.filter.outputs.ui == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('apps/ui/bun.lock') }}

.github/workflows/apps-ui-release.yml

@@ -47,7 +47,7 @@ jobs:
         with:
           bun-version: 1.3.14
       - name: Cache bun install
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('apps/ui/bun.lock') }}

.github/workflows/apps-ui-validate.yml

@@ -43,7 +43,7 @@ jobs:
           bun-version: 1.3.14
       - name: Cache bun install
         if: steps.filter.outputs.code == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('apps/ui/bun.lock') }}

.github/workflows/infra-compose-playwright-e2e.yml

@@ -99,7 +99,7 @@ jobs:
         with:
           bun-version: 1.3.14
       - name: Cache bun install
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('apps/ui/bun.lock', 'apps/api/bun.lock') }}

.gitleaks.toml

@@ -38,6 +38,12 @@ paths = [
   # valid 32-byte base64 fixture and rejects too-short / too-long
   # values. The fixture is generated for the test, not a live key.
   '''apps/api/tests/boot/invariants\.test\.ts''',
+  # The tsforge scaffold manifest is the config-surface source of truth:
+  # it declares which env-var *names* each AI provider requires (e.g.
+  # OPENAI_API_KEY, ANTHROPIC_API_KEY) and their non-secret defaults. The
+  # `generic-api-key` rule flags the provider/secret-keyword proximity,
+  # but the file holds only key names and placeholder config — no values.
+  '''\.tsforge/scaffold-manifest\.json''',
 ]
 # Docs setup recipes use the literal placeholder
 # `<set-from-your-secret-manager>` as the example value for secret-valued

apps/api/package.json

@@ -50,7 +50,7 @@
     "prepare": "husky 2>/dev/null || true"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "0.104.1",
+    "@anthropic-ai/sdk": "0.105.0",
     "@casl/ability": "7.0.0",
     "@elysiajs/cors": "1.4.2",
     "@elysiajs/jwt": "1.4.2",
@@ -59,29 +59,29 @@
     "@opentelemetry/auto-instrumentations-node": "0.76.0",
     "@opentelemetry/exporter-trace-otlp-http": "0.219.0",
     "@opentelemetry/resources": "2.7.1",
-    "@opentelemetry/sdk-node": "0.218.0",
+    "@opentelemetry/sdk-node": "0.219.0",
     "@opentelemetry/semantic-conventions": "1.41.1",
     "@sendgrid/mail": "8.1.6",
-    "@sentry/bun": "10.57.0",
+    "@sentry/bun": "10.59.0",
     "@sinclair/typebox": "0.34.49",
     "arctic": "3.7.0",
-    "bullmq": "5.78.1",
+    "bullmq": "5.79.1",
     "dotenv": "17.4.2",
     "drizzle-orm": "0.45.2",
-    "elysia": "1.4.28",
+    "elysia": "1.4.29",
     "elysia-rate-limit": "4.6.2",
     "fs-extra": "11.3.5",
     "handlebars": "4.7.9",
     "ioredis": "5.11.1",
     "nodemailer": "9.0.1",
-    "openai": "6.42.0",
+    "openai": "6.44.0",
     "otpauth": "9.5.1",
     "pg": "8.21.0",
     "pino": "10.3.1",
     "postgres": "3.4.9",
     "prom-client": "15.1.3",
-    "resend": "6.12.4",
-    "stripe": "22.2.1",
+    "resend": "6.14.0",
+    "stripe": "22.2.2",
     "web-push": "3.6.7"
   },
   "devDependencies": {
@@ -115,8 +115,8 @@
     "eslint-plugin-import": "2.32.0",
     "eslint-plugin-prettier": "5.5.6",
     "eslint-plugin-promise": "7.3.0",
-    "eslint-plugin-sonarjs": "4.0.3",
-    "eslint-plugin-unicorn": "67.0.0",
+    "eslint-plugin-sonarjs": "4.1.0",
+    "eslint-plugin-unicorn": "68.0.0",
     "globals": "17.6.0",
     "husky": "9.1.7",
     "knip": "6.16.1",