[mikeastock-bot]

Upgrades every dependency in the repo, plus all plugin submodules, in one PR. npm/pnpm versions respect the repo's 7-day release-age policy (scripts/package_manager_security_config.py), so some packages land a release or two behind latest.

Submodules

• All 14 plugins/* bumped to upstream HEAD.
• patches/poteto-mode.patch rebased onto cursor/plugins@d457567. Upstream renamed name: Poteto Mode → poteto-mode, which the patch already did; the 3-way merge needed no manual fixes.

Root (package.json)

Package	Before	After
@earendil-works/pi-*	^1.0.0	^1.1.0
openai	^6.46.0	^7.32.0
typebox	^1.3.6	^1.3.37
@types/node	^26.1.1	^26.6.5
pnpm (packageManager)	10.0.0	12.12.1

• New pnpm-workspace.yaml. pnpm 12 fails on unapproved build scripts, so it explicitly declines them (typecheck-only devDeps) and puts the 7-day age gate in the repo, which makes it apply in CI too:

  minimumReleaseAge: 10080
  allowBuilds:
    '@google/genai': false
    esbuild: false
    protobufjs: false

bb plugins (bb-plugins/*)

• @get-bb/plugin-sdk → 0.6.31 everywhere (was 0.4.6 / 0.4.104 in t3sidebar / tok-speed). The host reports SDK 0.6.32, which isn't on npm; 0.6.31 is the newest published version that doesn't get ahead of the host.
• TypeScript 5 → 7 (t3sidebar stays on its TS 6 alias), @types/node 22 → 26, plus zod, hono, react, hugeicons, better-sqlite3 13, bb-app 0.46.
• bb plugin types re-pinned the packages bb shims at runtime (sonner, radix, tailwind-merge, clsx) to the host's versions, and moved clsx/tailwind-merge in t3sidebar to devDependencies.
• tok-speed: added src/css.d.ts. TS 6+ checks side-effect imports by default, so import './app.css' broke typecheck.

skill-doctor

• @letta-ai/trajectory 0.3.0 → 0.4.3. The grok-build pnpm patch applies unchanged; only the filename and the patchedDependencies key changed.

CI

• actions/checkout and actions/setup-node v6 → v7.