Bump all frontend dependencies

.github/scripts/package.json

@@ -3,6 +3,6 @@
   "private": true,
   "devDependencies": {
     "@actions/github-script": "github:actions/github-script",
-    "typescript": "^5.9.3"
+    "typescript": "^6.0.3"
   }
 }

frontend/package.json

@@ -22,64 +22,64 @@
     "@fontsource/inter": "^5.2.8",
     "@radix-ui/react-collapsible": "^1.1.12",
     "@radix-ui/react-dialog": "^1.1.15",
-    "@tanstack/react-query": "^5.97.0",
-    "@tanstack/react-router": "^1.168.10",
+    "@tanstack/react-query": "^5.100.14",
+    "@tanstack/react-router": "^1.170.8",
     "@vector-im/compound-design-tokens": "6.10.1",
     "@vector-im/compound-web": "^8.3.5",
     "@zxcvbn-ts/core": "^3.0.4",
     "@zxcvbn-ts/language-common": "^3.0.4",
     "classnames": "^2.5.1",
-    "date-fns": "^4.1.0",
-    "i18next": "^26.0.4",
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4",
-    "react-i18next": "^17.0.2",
-    "swagger-ui-dist": "^5.31.0",
-    "valibot": "^1.2.0",
+    "date-fns": "^4.3.0",
+    "i18next": "^26.2.0",
+    "react": "^19.2.6",
+    "react-dom": "^19.2.6",
+    "react-i18next": "^17.0.8",
+    "swagger-ui-dist": "^5.32.6",
+    "valibot": "^1.4.0",
     "vaul": "^1.1.2"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.2",
+    "@biomejs/biome": "^2.4.15",
     "@browser-logos/chrome": "^2.0.0",
     "@browser-logos/firefox": "^3.0.10",
     "@browser-logos/safari": "^2.1.0",
-    "@graphql-codegen/cli": "^6.2.1",
-    "@graphql-codegen/client-preset": "^5.2.3",
-    "@graphql-codegen/typescript-msw": "^4.0.0",
+    "@graphql-codegen/cli": "^7.0.0",
+    "@graphql-codegen/client-preset": "^6.0.0",
+    "@graphql-codegen/typescript-msw": "^4.0.1",
     "@graphql-typed-document-node/core": "^3.2.0",
-    "@storybook/addon-docs": "^10.3.5",
-    "@storybook/react-vite": "^10.3.5",
-    "@tanstack/react-query-devtools": "^5.97.0",
-    "@tanstack/react-router-devtools": "^1.166.11",
-    "@tanstack/router-plugin": "^1.167.12",
+    "@storybook/addon-docs": "^10.4.1",
+    "@storybook/react-vite": "^10.4.1",
+    "@tanstack/react-query-devtools": "^5.100.14",
+    "@tanstack/react-router-devtools": "^1.167.0",
+    "@tanstack/router-plugin": "^1.168.11",
     "@testing-library/jest-dom": "^6.9.1",
-    "@testing-library/react": "^16.3.1",
+    "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "^25.3.0",
-    "@types/react": "19.2.14",
+    "@types/node": "^25.9.1",
+    "@types/react": "19.2.15",
     "@types/react-dom": "19.2.3",
     "@types/swagger-ui-dist": "^3.30.6",
-    "@vitejs/plugin-react": "^6.0.1",
-    "@vitest/coverage-v8": "^4.1.3",
-    "autoprefixer": "^10.4.23",
+    "@vitejs/plugin-react": "^6.0.2",
+    "@vitest/coverage-v8": "^4.1.7",
+    "autoprefixer": "^10.5.0",
     "browserslist-to-esbuild": "^2.1.1",
-    "graphql": "^16.12.0",
-    "happy-dom": "^20.8.9",
-    "i18next-cli": "^1.51.7",
-    "knip": "^5.81.0",
-    "msw": "^2.12.8",
-    "msw-storybook-addon": "^2.0.6",
-    "postcss": "^8.5.12",
+    "graphql": "^16.14.0",
+    "happy-dom": "^20.9.0",
+    "i18next-cli": "^1.58.0",
+    "knip": "^6.14.2",
+    "msw": "^2.14.6",
+    "msw-storybook-addon": "^2.0.7",
+    "postcss": "^8.5.15",
     "postcss-import": "^16.1.1",
     "postcss-nesting": "^14.0.0",
-    "rimraf": "^6.1.2",
-    "storybook": "^10.1.11",
+    "rimraf": "^6.1.3",
+    "storybook": "^10.4.1",
     "tailwindcss": "^3.4.19",
-    "tinyglobby": "^0.2.15",
-    "typescript": "^5.9.3",
-    "vite": "8.0.0",
-    "vite-plugin-graphql-codegen": "^3.8.0",
-    "vitest": "^4.0.15"
+    "tinyglobby": "^0.2.16",
+    "typescript": "^6.0.3",
+    "vite": "8.0.14",
+    "vite-plugin-graphql-codegen": "^3.9.1",
+    "vitest": "^4.1.7"
   },
   "msw": {
     "workerDirectory": [

package.json

@@ -1,9 +1,9 @@
 {
   "name": "matrix-authentication-service",
   "private": true,
-  "packageManager": "pnpm@11.1.0+sha512.0c44e842e5686b2c061a81adda8b2258bd8818e9704b2cf2c63d56b931a7b2e910092e085027003b96ca3911ab56a07f6df5abaed2be9925034cdd686a535b14",
+  "packageManager": "pnpm@11.3.0+sha512.2c403d6594527287672b1f7056343a1f7c3634036a67ffabfcc2b3d7595d843768f8787148d1b57cf7956c90606bbd192857c363af19e96d2d0ec9ec5741d215",
   "devDependencies": {
     "@localazy/cli": "^2.0.10",
-    "semver": "^7.8.0"
+    "semver": "^7.8.1"
   }
 }

pnpm-workspace.yaml

@@ -22,6 +22,10 @@ trustPolicyExclude:
   # @actions/github-script bundles @actions/http-client which pulls in
   # undici@5.29.0 — older 5.x releases were published with provenance.
   - "undici@5.29.0"
+  # They switched to npm staged publishing, which for some reason npm flags
+  # from being a release with a trusted publisher (GH actions) and provenance
+  # to one with only provenance.
+  - "tinyexec@1.2.2"
 
 # Fail the install if any dependency has a build script that isn't explicitly
 # allowed. Add entries to `allowBuilds` (package name pattern -> bool) to