Consolidate grouped Dependabot updates across site, worker, GitHub app, and .NET projects

[Copilot]

Pull Request Template

Description

Consolidates the 17 open Dependabot PRs into the requested strategic update groups by applying the version bumps on a single validation branch. The change updates framework, security, dev-tooling, and utility dependencies across the site, worker, GitHub app server, and .NET projects, with one compatibility adjustment required by the TypeScript 7 upgrade.

• Site dependency groups

  • Upgrades next to 16.2.12
  • Upgrades react-day-picker to 10.0.1
  • Upgrades @radix-ui/react-collapsible to 1.1.20
  • Upgrades @radix-ui/react-tooltip to 1.2.16
  • Upgrades @playwright/test to 1.62.1
  • Applies the postcss security floor and refreshes sharp

• Worker dependency groups

  • Upgrades jose to 6.2.5
  • Upgrades wrangler to 4.118.0
  • Upgrades @cloudflare/workers-types to 5.20260731.1

• GitHub app server dependency group

  • Upgrades @types/node to 26.1.2
  • Upgrades typescript to 7.0.2
  • Adds explicit Node ambient types so the TypeScript 7 toolchain continues resolving node: imports and globals

• .NET dependency groups

  • Upgrades ModelContextProtocol to 2.0.0
  • Upgrades Microsoft.Extensions.Hosting to 10.0.10
  • Upgrades Microsoft.ML.OnnxRuntimeGenAI.Managed to 0.15.1
  • Upgrades Microsoft.NET.Test.Sdk to 18.8.1 across test projects

• Lockfile refresh

  • Regenerates site/pnpm-lock.yaml
  • Regenerates worker/package-lock.json
  • Regenerates github-app-server/package-lock.json

Example of the compatibility change required by the grouped updates:

{
  "compilerOptions": {
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "types": ["node"]
  }
}

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

• dotnet build GauntletCI.slnx --configuration Release
• dotnet test GauntletCI.slnx --configuration Release --no-build

Test Configuration:

• Firmware version:
• Hardware:
• Toolchain: .NET 8, Node.js/npm, pnpm
• SDK:

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules
• I have checked my code and corrected any misspellings

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 13 changed files in this pull request and generated no new comments.

Files not reviewed (3)

• github-app-server/package-lock.json: Generated file
• site/pnpm-lock.yaml: Generated file
• worker/package-lock.json: Generated file

Suppressed comments (2)

site/package.json:58

• next was bumped to 16.2.12, but eslint-config-next is still pinned to the 15.x line. This version skew is likely to cause peer-dependency and/or lint rule mismatches; these packages are intended to track the same major version. Update eslint-config-next (and the lockfile) to a compatible 16.x release matching the Next.js major.

    "next": "16.2.12",
    "next-themes": "^0.4.6",
    "react": "^19",
    "react-day-picker": "10.0.1",

github-app-server/package.json:17

• github-app-server runs on Node 22 (see github-app-server/Dockerfile installing setup_22.x), but @types/node is set to ^26.1.x. This can allow use of Node 26-only APIs at compile time that won’t exist at runtime on Node 22. Consider aligning @types/node to the runtime major (e.g. ^22) or bumping the runtime Node version accordingly, and then update the lockfile.

    "@types/node": "^26.1.2",
    "esbuild": "0.28.1",
    "tsx": "^4.23.1",
    "typescript": "^7.0.2"

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dfd9944dd8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update DayPicker classNames for v10

When the site workflows run pnpm run build, Next type-checks every **/*.tsx in site/tsconfig.json; react-day-picker v10 removes the deprecated table classNames key, but the copied Calendar wrapper still passes table in site/components/ui/calendar.tsx:87. This makes the v10 bump fail strict TypeScript checking (and would drop the month grid styling if bypassed), so the wrapper needs the v10 key such as month_grid before upgrading.

Useful? React with 👍 / 👎.