[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "after 2am and before 3am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

🦋 Changeset detected

Latest commit: 80f78ab

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@checkstack/backend	Patch
@checkstack/frontend	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (1) — an upgrade path exists, so these fail the build:
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (4) — an upgrade path exists, so these fail the build:
  [MEDIUM] glob 13.0.6 -> fixed in 14.0.2  (CVE-2026-118773)
  [MEDIUM] minimatch 10.2.6 -> fixed in 11.0.1  (CVE-2026-118764)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.0  (CVE-2026-118660)
  [HIGH] happy-dom 20.14.6 -> fixed in 21.0.4  (CVE-2026-115895)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.