[verascheunert]

Summary

Replaces the open bot PRs (11 Renovate, 7 Dependabot) plus the rate-limited items from the Dependency Dashboard with one branch built fresh from main.

 package.json              @types/node 24→26, faker 10.6, execa 10.2.1, tsdown 0.23.7, turbo 2.11.10, oxlint 1.92, oxfmt 0.77, npm 12.2.2
 packages/cli/package.json yargs 17→18, @napi-rs/keyring 1→2, dotenv 17→18, playwright 1.65
 packages/sdk/package.json p-retry 8→9, axios 1.20
 .node-version             24.22.1 → 26.13.0
 .github/workflows/*       setup-node 7.1.0, upload-artifact 7.0.2, download-artifact 8.0.2, codeql 4.39.3, sonarqube-scan 8.4.1, ketryx 2.0.0
 package-lock.json         regenerated; carries the Dependabot transitive bumps (axios, qs, brace-expansion, ip-address, markdown-it, source-map-js)

Code changes are confined to tests and tool config:

• class mocks in cli.test.ts, cli-functions.spec.ts, auth.spec.ts, token-storage.spec.ts use function implementations (vitest 4+ rejects arrow functions for anything called with new, so this is ready for that upgrade)
• vite.config.ts imports defineConfig from vitest/config
• tsdown.config.ts external pattern now matches msw/node, which was being inlined into the published @aignostics/sdk/test bundle (565 KB → 24 KB)
• yargs 18 resolves main() after --help instead of throwing; the help test asserts on the printed usage only

Deliberately left out, each needs its own decision

• vitest 4 (security PR chore(deps): update dependency vitest to v4 [security] - autoclosed #178), vitest 5 (chore(deps): update vitest monorepo to v5 - autoclosed #133) and msw 3: all pull vite 7+, which depends on lightningcss (MPL-2.0). license-checking-config.json lists MPL-2.0 as prohibited and the pre-commit hook blocks the lockfile. It is dev-only and transitive, but allowlisting it is a legal call. Until then the vitest security advisory stays open.
• openid-client 6 (fix(deps): update dependency openid-client to v6 - autoclosed #127): the v5 Issuer/Client API is gone, auth.ts needs a rewrite.
• TypeScript 7 (chore(deps): update dependency typescript to v7 #131): typedoc and tsdown's dts build need the 5.x compiler API.

Evidence

Local on Node 24: build, typecheck, lint, format check, unit tests and coverage thresholds pass for both packages (12 test files). Built bin.cjs and bin.js run with ESM-only yargs 18 from a CJS entry.

The e2e job already fails on main (403 from staging on applications versions get), unrelated to this change.

Merge Danger

Door: two-way

Revert restores the previous lockfile and pins. Nothing is published by merge alone; release-please cuts the release.

Blast Radius: consumers

• @aignostics/cli now depends on ESM-only yargs 18 (Node 20.19+, 22.12+ or newer) while engines still says >=18. Node 18 is EOL. I left engines alone; say the word and I bump it.
• keyring 2 throws on a locked or inaccessible OS keychain instead of returning null. token-storage.ts already wraps every call in try/catch with a file fallback, so behavior is unchanged.
• Ketryx action 2 runs on Node 24, fine on GitHub-hosted runners.

🤖 Generated with Claude Code

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch chore/deps-mega-update → main

View scan in OX Security →

[verascheunert]

Answering a review question from @tobi-ax on auth.spec.ts (Client: vi.fn(() => mockClient) became vi.fn(function () { ... }), "Why?"):

auth.ts does new issuer.Client(...). vitest 4 changed vi.fn so an arrow function implementation can no longer be called with new, it throws "is not a constructor". Only function or class implementations work for that. Same for vi.mocked(Entry) in token-storage.spec.ts and AuthService in cli.test.ts.

vitest 5 was in this PR until the license hook blocked it (vite 7+ pulls in lightningcss, MPL-2.0), so the mocks got fixed first and the bump dropped later. I kept the mock change because it is harmless on vitest 3 and saves whoever does the upgrade from hitting it again.

Written with Claude.