[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "after 2am and before 3am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

🦋 Changeset detected

Latest commit: 34d4fb7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@checkstack/backend	Patch
@checkstack/frontend	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (6) — an upgrade path exists, so these fail the build:
  [MEDIUM] nodemailer 9.1.1 -> fixed in 10.0.9  (GHSA-g57g-f23g-4646)
  [MEDIUM] nodemailer 9.1.1 -> fixed in 10.0.2  (GHSA-8vvx-rff5-p5rq)
  [MEDIUM] nodemailer 9.1.1 -> fixed in 10.0.2  (GHSA-6vj9-mwq6-2f5v)
  [MEDIUM] nodemailer 9.1.1 -> fixed in 10.0.10  (CVE-2026-110871)
  [HIGH] nodemailer 9.1.1 -> fixed in 10.0.6  (GHSA-v53p-9fqp-m79j)
  [HIGH] nodemailer 9.1.1 -> fixed in 10.0.5  (CVE-2026-90776)

⚠️  Known unfixed vulnerabilities (1) — surfaced, not gated:
  [HIGH] braces 3.0.3  (CVE-2026-93687) — no upstream fix yet

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (1) — an upgrade path exists, so these fail the build:
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (1) — an upgrade path exists, so these fail the build:
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.