chore: update dependencies, Rust crates and CI action pins

[kernoeb]

Routine dependency refresh across every module type: bun/JS workspaces and catalogs, the Rust/Tauri crates, the Docker base images and the GitHub Actions pins.

Notable bumps

Package	From → to	Verdict
elysia	1.4.29 → 1.4.30	Security. Fixes GHSA-gmm9-qwx3-2m3h (CVSS 9.0, RCE via unescaped schema defaults and property names, <= 1.4.29). We build schemas statically, so we were not exploitable, but the fix is free.
better-auth + @better-auth/passkey	1.6.23 → 1.7.3	Breaking, 2 lines. No database migration. See below.
zod	4.4.3 → 4.5.4	Safe, and required by better-auth 1.7.3. The 4.5 soundness fixes (datetime seconds, code-point string lengths, stricter ipv6/ulid/httpUrl) touch nothing we use.
@elysiajs/openapi	1.4.15 → 1.4.16	Safe. New peers @sinclair/typebox >= 0.34 and typescript >= 5 are both already satisfied.
@logtape/logtape	2.2.4 → 2.3.4	Safe. Additive only; we do not use configureSync or fingersCrossed.
daisyui	5.6.16 → 5.7.28	Safe to build, needs visual QA. Four restyles hit classes we use: tooltip font weight, disabled ghost button, Cally selected-day hover, <details>/<summary> children.
@schedule-x/*	4.6.1 → 4.8.0	Safe. Theme CSS is byte-identical and every sx__* class name is unchanged, so our 17 overrides still apply. Real fix included: the current-time indicator no longer leaves a ghost line after midnight.
@lucide/vue	1.23.0 → 1.43.0	Safe to build, needs visual QA. Of the 44 icons we import, 3 were redrawn: Calendar, CalendarCheck2, Ghost. Icons now also emit aria-hidden="true" by default and dropped the lucide-*-icon class.
vite	8.1.3 → 8.2.2	Safe. Required by rollup-plugin-bundle-stats 4.22.3, which narrowed its peer to ^8.2.2.
@antfu/eslint-config	9.1.0 → 9.5.1	Safe. perfectionist({}) in apps/api/eslint.config.js still returns the same single config, and the resolved rule map is identical. Needs eslint-plugin-perfectionist >= 5.10.1, bumped to 5.11.0 in the same change.
playwright	1.61.1 → 1.63.0	Safe. Chromium 149 → 153, so expect one CI browser-cache miss.
tailwindcss	4.3.2 → 4.3.3	Safe, but the default font-sans stack now uses explicit platform fonts instead of system-ui.

Held back on purpose

• typescript stays on 6.0.3. TypeScript 7 is GA but ships no programmatic API, so vue-tsc cannot run at all (2 of our 4 typecheck targets) and typescript-eslint has closed TS 7 support as not planned. Both are waiting on the TS 7.1 stable API. Our tsconfigs are already TS 7-shaped, so the migration is cheap once the tooling lands. There is no newer 6.x to take.
• temporal-polyfill stays on 0.3.2. @schedule-x/calendar 4.8.0 still pins temporal-polyfill@0.3.0 exactly. 1.x splits Temporal identity in browsers with native Temporal and silently blanks the calendar. test/deps.temporal-schedulex.test.ts guards this.
• @simplewebauthn/server stays on 13.x (13.3.2 → 13.3.3). @better-auth/passkey 1.7.3 depends on ^13.3.1; taking 14.0.1 would split the tree into two copies and break type inference.
• Docker base images unchanged. oven/bun follows .bun-version (already 1.4.2, the latest Bun), chainguard/glibc-dynamic:latest and microcheck:1 float, and postgres:18 is the current major.
• GitHub Actions: only actions/setup-node had a newer major. Everything else was already on its latest major.
• tools/ade-to-json-extension is untouched. It is outside the bun workspaces and on a separate npm toolchain (eslint 9, TypeScript 5.9, vite 7, unocss); updating it is its own job.

Code changes the bumps forced

Both in apps/api/src/utils/auth.ts, from better-auth 1.7:

1. mapProfileToUser must now return OAuthMappedUser, which declares id?: never — provider identity moved to accountSubject. return profile is now a type error. Changed to return {}: the function only exists for its Discord avatar-refresh side effect, and better-auth already maps name/email/image/emailVerified itself.
2. ctx.params is now possibly undefined in createAuthMiddleware, so the /callback/:id redirect reads ctx.params?.id and guards on it.

The generated apps/api/src/db/schemas/auth.ts was left as-is on purpose. Re-running generate-better-auth drops the UNIQUE constraint on passkey.credential_id (migration 0008 created it) in favour of a plain index. That is a generator-output difference, not a better-auth change — the plugin declares the same credentialID: { type: 'string', required: true, index: true } in 1.6.23 and 1.7.3 — so the stricter local constraint is kept. drizzle-kit generate reports no schema changes.

Verification

• bun run lint-fix && bun run lint && bun run typecheck — clean across all workspaces
• bun run test:unit — 148 pass, 0 fail (24 files), including the temporal-polyfill × Schedule X guard
• apps/extension and apps/app (excluded from the root fan-out) — lint, typecheck and build clean
• NODE_ENV=production bun run build — api + web build clean
• bun install --frozen-lockfile — clean
• bun run validate:workflows — 3 workflows OK
• bun run docker:build — passes, the full in-container frozen-install → lint → typecheck → build → test:unit path
• cargo check in apps/app/src-tauri — compiles clean on the refreshed lockfile

Before deploying

better-auth 1.7.3 turns on runtime schema validation by default, including production. Our schema passes the check. It also rejects account lookups that match more than one row, so run this once against prod first:

SELECT "providerId", "accountId", count(*) FROM account GROUP BY 1,2 HAVING count(*) > 1;

Follow-ups, not done here

• @schedule-x/timezone-select is installed but never imported (App.vue notes its CSS is intentionally omitted).
• rollup-plugin-bundle-stats is commented out in apps/web/vite.config.ts; keeping it pins vite to ^8.2.2.
• vite 8.2's native config loader warns about apps/extension/vite.config.background.ts (JSON import without attributes, extensionless import) and scripts/utils.ts (__dirname). Advisory only — the build succeeds.

🤖 Generated with Claude Code