chore(deps): refresh workspace and GitHub Actions dependencies - #85

Refresh dependencies while preserving the existing Node support range, SDK exports, and D1 schema. This is dependency and CI maintenance only; it does not deploy, migrate production data, or publish a release.

Updates

• Runtime: Better Auth 1.6.25 → 1.6.30, its auth generator 1.6.23 → 1.6.30, Hono 4.12.32 → 4.13.5, jose 6.2.4 → 6.2.10, React Query 5.101.4 → 5.102.4, and Carapace 0.6.0 → 0.6.2.
• Tooling: pnpm 11.2.2 → 11.24.0, Biome 2.5.5 → 2.5.10, Vite 8.1.5 → 8.2.2, React Vite plugin 6.0.4 → 6.1.0, Vitest 4.1.10 → 4.1.11, Wrangler 4.114.0 → 4.126.0, esbuild 0.28.1 → 0.28.2, tsx 4.23.1 → 4.23.12, and Node/React/Worker types. Replace @cloudflare/vitest-pool-workers 0.18.8 with its renamed successor, @cloudflare/vitest-plugin 1.1.0; only the package name, import, and types entry change.
• Actions: refresh the CodeQL v4 commit pin; pnpm/action-setup 6.0.9 → 6.0.10; actions/stale 10 → 11.0.0; upload-artifact 4 → 7.0.1; download-artifact 4 → 8.0.1. All remain pinned to full commit SHAs. Workflow triggers and permissions are unchanged.
• Regenerate the pnpm lockfile, update the Biome schema and setup documentation, and add an Unreleased changelog entry. Preserve the two-day release cooldown and existing supply-chain controls.

Held upgrades

• Better Auth/auth 1.7.x: the runtime requires account.issuer, absent from the current Drizzle schema and D1 migrations. The attempted upgrade failed 73 Worker tests. Keep the newest compatible 1.6.30 versions; a schema migration needs separate work.
• jsdom 30.0.1: requires Node ^22.22.2 || ^24.15.0 || >=26.0.0, narrower than the current project contract. Keep 29.1.1 rather than raise the Node minimum here.
• Clipanion 4.0.0-rc.4: a prerelease; keep stable 3.2.1.
• Releases still inside the existing two-day cooldown are not selected: Cloudflare Vitest plugin 1.1.1, Wrangler 4.127.0, Worker types newer than 5.20260826.1, and sharp 0.35.4. The current compatible versions remain locked.

Proof

Validated on Node 24.20.0 with pnpm 11.24.0:

• Frozen install using the CI flags, actionlint, pnpm lint (172 files; six non-failing warnings), and pnpm typecheck across all six packages.
• pnpm test: 252 passed, comprising 6 script tests, 37 core tests, 33 React tests, 48 CLI tests, and 128 Worker tests across 22 Vitest files. No test assertions or deadlines changed.
• Admin build (250 modules), demo build (19 modules), and docs build (17 pages).
• pnpm verify:sdk-packages: both exact SDK tarballs load their runtime and TypeScript entry points.
• CLI build and built --help smoke test.
• The updated auth generator reproduces the checked-in schema exactly after the repository's Biome formatting step; no schema or migration file changes.
• pnpm audit: 0 vulnerabilities, 509 dependencies.
• Codex autoreview: clean, with no accepted/actionable findings.

The first local test attempt hit 13 CLI subprocess timeouts. The previous tsx version reproduced the same problem; isolating temporary storage resolved it, and the latest tsx passed all 48 CLI tests in 7.38 seconds. The final Worker suite exited successfully despite two non-failing workerd internal-error messages. The admin build retains its non-failing chunk-size warning.

PR verification is green: all five CI jobs, CodeQL, and dispatch. No CI reruns were needed.

Default-branch CI, CodeQL, Docs, Stale, ClawSweeper Dispatch, and the last manual Cloudflare deployment were green before this change. The latest tag-only SDK release workflow was also green. No baseline CI repair was needed.

Existing dependency PRs

This update fully covers #60, #68, #69, #77, and #82. It partially covers #79 but intentionally holds its Better Auth 1.7 change. #78 remains held with jsdom 30. No existing PRs were closed.