[ghostleek]

The repository has 13 open Dependabot PRs and 12 open security alerts on main. This batch updates both npm dependency trees together, uses patched releases within the requested major versions, and includes the Express 5 compatibility changes needed to keep the API working.

Batched updates

Dependency	Version in this batch	Supersedes
peaceiris/actions-gh-pages	v4	#16
dotenv (root and backend)	17.4.2	#19, #44
express / @types/express (root and backend)	5.3.0 / 5.0.6	#23
helmet (root and backend)	8.3.0	#26, #42
@playwright/test	1.64.1	#30
prisma / @prisma/client (root and backend)	6.19.3 / 6.19.3	#31, #33
actions/setup-node	v6	#34
vite	7.3.7	#43
@types/node (root and backend)	24.19.2	#45
actions/checkout	v6	#55

Security coverage

Checked every occurrence in the corresponding lockfile against every affected range in the current GitHub advisory, including the separate Express 5/body-parser 2 and Vite 7 ranges:

Package	Locked version	Dependabot alert IDs
source-map-js	1.2.2	45
proxy-addr	2.0.8	47, 50
body-parser	2.4.0	48, 56
qs	6.17.0	49, 57
vite	7.3.7	51–55

Both lockfiles return 0 vulnerabilities from npm audit --package-lock-only.

Prisma 6 introduces @prisma/config -> deepmerge-ts@7.1.5, which is affected by GHSA-ggr8-5vv4-36mx. Both manifests therefore scope an override to @prisma/config -> deepmerge-ts@8.0.0. Prisma uses its public deepmerge export; schema generation and migration deployment succeed with this override. Remove it when a subsequent Prisma release in the selected line uses a patched version.

Compatibility changes

• Replace the unnamed wildcard 404 route with a final pathless handler, and preserve empty-object request bodies for existing validation. Add regression tests for root/nested JSON 404s and absent/unparsed bodies.
• Type authenticated :id parameters explicitly to accommodate the Express 5 parameter types.
• Update checkout/setup-node in both workflows. Move the manual static export from Node 18 to Node 22, matching the existing application engine requirement.
• Extend CI to install, generate, and build the standalone backend as well as the root application.

Express 5 migration guidance and Vite 7 migration guidance informed these compatibility changes.

Validation

Validated locally on Node 22.23.4:

• Clean npm ci for both manifests; root-only installation also type-checks and imports the Vercel API entry point without backend node_modules.
• Frontend production build, backend type check, standalone backend build, and API startup import.
• All six existing Prisma migrations applied to a fresh isolated local PostgreSQL 14 database.
• 10/10 backend tests passed.
• 38/38 Playwright tests passed across desktop and mobile, including host creation/sharing, guest play, draft recovery, CSV import, private-game handling, and recentering. Identity responses use the existing fixtures; Bingo HTTP routes and database are real.
• Both npm audits report zero vulnerabilities; all 12 baseline alerts fall outside the locked versions' affected ranges.
• git diff --check passes.

GitHub validation also passed: integration workflow with PostgreSQL 16, both CodeQL analyses, GitGuardian, and the Vercel preview build. The default-branch alerts will remain open until this PR is merged and GitHub rescans. This PR does not merge the updates or run the manual static export.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
bingo-string	Ready	Preview	Oct 28, 2026 8:42am UTC