chore(deps): update minor and patch dependencies past the release-age gate - #9894

Summary

Minor and patch updates that are past the 7-day release-age gate and need no code changes:

• Security: es-toolkit 1.53.1 (prototype-pollution fixes in compat helpers); fast-xml-parser 5.12.0 via a root override, following the existing pattern for patched transitive deps (fixes GHSA-474x-hrwr-fgx4; consumers @azure/core-xml, @better-auth/sso, @google-cloud/storage, @aws-sdk/xml-builder all declare ^5)
• Server: jose 6.2.15 (stricter Base64URL/UTF-8/JWKS validation, JWE decompression cap), ws 8.22.1 (dependency and root override), nodemailer 10.3.1, mssql 12.7.13, neo4j-driver 6.3.0, @azure/storage-blob 12.34.0, resend 6.37.0, posthog-node 5.61.2 (fixes a request-body memory leak on newer Node; Sim calls none of the flag methods it deprecates), @google/genai 2.32.0, re2js 2.9.1, ipaddr.js 2.5.0
• Client: @tanstack/react-virtual 3.14.26 (app and emcn), zustand 5.0.16, @floating-ui/dom 1.8.0, posthog-js 1.445.5, @react-email/render 2.2.0, react-email 6.11.6
• Tooling: tailwindcss / @tailwindcss/postcss 4.3.4, @vitejs/plugin-react 6.2.1, @clack/prompts 1.8.1, @opentelemetry/semantic-conventions 1.44.0
• @clack/prompts 1.8 now types the cancel value as its exported CANCEL_SYMBOL, so sim-setup's guardCancel takes T | typeof CANCEL_SYMBOL. isCancel then narrows on its own and the as T cast goes away
• Left out on purpose:
  • turbo 2.11 landed separately in chore(deps): bump turbo to 2.11.10 #9903 (route-group glob, task-level affectedTasks, prerequisite handling)
  • tiptap 3.32 landed in chore(deps): bump tiptap to 3.32.2 and keep headings that open a list item #9898; @tiptap/y-tiptap stays on 3.0.7 there because 3.0.8+ loses concurrent peer edits inside a list
  • @daytona/sdk 0.227 landed with AWS SDK 3.1162 and OpenTelemetry 0.223 in chore(deps): bump AWS SDK to 3.1162.0, OpenTelemetry to 0.223.0/2.12.0, and @daytona/sdk to 0.227.3 #9900, keeping one copy of each

Type of Change

• Dependency update

Testing

• bun install --frozen-lockfile is clean, and every bumped package resolves to one hoisted copy. The only new nested entries are html-to-text 10 under @react-email/render (the app pins 9 directly) and tslib / @types/node placement shifts.
• ipaddr.js 2.5.0 parses ::127.0.0.1, ::10.0.0.1, ::169.254.169.254, and ::ffff:127.0.0.1 exactly like 2.3.0, checked side by side. The existing SSRF/egress cases for IPv4-compatible and IPv4-mapped forms pass.
• 96 test files next to the updated packages' callers pass, 1,422 tests in all: JWT signing/verification (internal auth, workload identity, credential minters, Gong/Zoho webhooks), SMTP/Gmail/mailer, Neo4j, MSSQL, Gemini/Google providers, Azure Blob client, PostHog, the linear-regex guard, and the rich markdown editor including collaboration.
• packages/security passes (211 tests), and so does packages/sim-setup (91).
• The full type-check passes for all 27 workspace tasks
• The root scripts suite passes (743 tests), including the CI planner attribution tests that run real Turborepo
• Full type-check, lint, audits, builds, and workspace suites run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code