[tobias-gp]

Merges all eight open Dependabot PRs into one branch and fixes what broke or was misconfigured along the way.

Included Dependabot PRs

Each Dependabot branch is merged as-is, so the original commits are kept. Where two PRs bumped the same package, the higher version wins.

PR	Update	Result here
#109	minor-and-patch group, 41 packages	merged in full
#115	zod 4.5.4 → 4.6.6	^4.6.6, resolves to 4.6.7 (#109 alone had 4.6.5)
#111	hono 4.13.7 → 4.13.11	superseded by #109 (4.13.13)
#113	astro 7.3.2 → 7.3.3	superseded by #109 (7.3.8)
#114	sharp 0.35.4 → 0.35.5	same as #109
#110	vite 8.2.2 → 8.2.4 (lockfile only)	superseded by #109 (8.3.4)
#101	js-yaml → 5.4.1	api/core/root bumped; the docs part broke the docs build, see fixes
#100	ioredis 5 → 6 (major)	bumped, see notes

Closes #100, closes #101, closes #109, closes #110, closes #111, closes #113, closes #114, closes #115

The E2E failures on #109/#110/#111 came from docker compose pull hitting the removed MinIO image. They had nothing to do with the bumps and were fixed on main in dfdc440.

Fixes

• Docs build broken by chore(deps)(deps): bump js-yaml from 4.3.2 to 5.4.1 #101 (a5d8a5d). Starlight 0.42 default-imports js-yaml 4. Astro 7 leaves that import external in the prerender bundle, so it resolves from apps/docs. That package had a js-yaml 4 devDependency shim for exactly this reason, and Dependabot bumped the shim to 5, which has no default export. js-yaml is now bundled in Astro's prerender Vite environment so it resolves from Starlight's own dependency, and the shim is removed so it can't be bumped into breakage again.
• DST bug in the dashboard and token-usage windows (0854e30). "Last N days" used local-time setDate(), which is 25h off across a DST switch, while the day buckets are keyed by UTC date. Switched to UTC date math. This also showed up as two integration tests failing locally today (DST change in Europe), though CI runs in UTC.
• turbo 2.11 rewrites AGENTS.md (8d59e7a). The new turbo version injects a managed guidance block into AGENTS.md whenever an AI agent runs it. Opted out with "agentGuidance": false in turbo.json.
• Dependabot config (77c5a34). prefix: chore(deps) plus include: scope produced chore(deps)(deps): titles; fixed for all three ecosystems. The dependencies, github-actions and docker labels the config references were also missing from the repo. Dependabot flagged that on every PR, so I created them.

Notes on riskier bumps

• ioredis 6 defaults to RESP3 and needs Node ≥20 (we run 26). We only use lrange, publish/subscribe, setex/exists/del, and none of their reply shapes change under RESP3. Tested against a live Redis with ioredis 6.0.0 (resp=3): pub/sub message events, lrange, setex/exists behave as before. BullMQ keeps its own ioredis 5. It only ever gets plain connection options (getQueueConnectionOptions), never one of our client instances, so having two ioredis versions installed is harmless.
• @modelcontextprotocol/server / hono go from 2.0.0-beta.5 / 2.0.0-alpha.2 to stable 2.3.1 / 2.0.2. Typecheck, the emitting API build and the MCP tests pass. E2E on this PR covers the live endpoint.
• React 19.3, Vite 8.3, Astro 7.3.8: the frontend and docs builds pass.
• Already on main and unrelated to these bumps: pnpm warns about an unmet peer for deepagents (langsmith >=0.7.1 <0.10.0, found 0.10.x). Nothing breaks.

Verification

• pnpm install --frozen-lockfile ✅
• pnpm typecheck ✅ · pnpm lint ✅
• npx vitest run: 1028/1028 ✅ (local TZ, CET)
• pnpm --filter @archmax/api build ✅ · pnpm build (all 6, including docs and frontend) ✅
• E2E: CI on this PR

No OpenSpec proposal: dependency updates and bug fixes are exempt.

🤖 Generated with Claude Code

[github-actions]

Docker image ready

docker pull ghcr.io/archmax-ai/semantics:pr-116