chore(deps): update weekly dependencies

[ZL-Asica]

Summary

Weekly dependency refresh across the application toolchain, including Node 24.21.0, pnpm 12.5.1, Zod 4, current TanStack packages, and regenerated runtime types. TypeScript remains pinned exactly to 6.0.3 to stay within the ESLint toolchain's supported range.

Key Changes

• Updated current-major runtime and development dependencies, plus Node 24.16.0 to 24.21.0 and pnpm 11.5.2 to 12.5.1.
• Upgraded Zod to 4.6.5, removed the stale Zod 3 workspace override, and refreshed TanStack Start/Router packages together.
• Pinned typescript to exactly 6.0.3 in the manifest and lockfile because the ESLint toolchain does not yet support newer TypeScript releases.
• Upgraded @testing-library/jest-dom to 7.0.1 rather than the deprecated 6.10 accidental breaking release, and moved @cloudflare/workers-types to 5.x for Wrangler peer compatibility.
• Regenerated cloudflare-env.d.ts and src/routeTree.gen.ts; route paths and IDs are unchanged.
• Added an exact Prisma 7.10.0 trust-policy exception after verifying its npm signature, prismabot publisher, and official Prisma repository.
• Recorded pnpm 12.5.1's package-manager environment document in pnpm-lock.yaml, which frozen CI installs require alongside the unchanged project lock document.

Validation

Commands run:

• pnpm install --frozen-lockfile
• pnpm peers check
• pnpm exec tsc --version (6.0.3)
• pnpm run cf-typegen
• pnpm run lint:ci
• pnpm run test (twice; 72 files and 284 tests)
• pnpm run build (twice)
• pnpm run release:preflight (twice)
• git diff --check

Additional validation:

• Repeated the one intermittently failing rating-batch test 10 times in isolation; all 10 runs passed.
• A focused subagent audit verified the exact TypeScript pin, Zod/TanStack compatibility, generated route stability, and pnpm 12 two-document lockfile integrity.

Skipped checks:

• pnpm run lint:fix was not run separately because pnpm run lint:ci passed and the committed diff was already clean.

UI Verification

Chrome smoke testing completed against the upgraded local application:

• Public homepage rendered correctly.
• Authenticated Groups list and group detail rendered correctly.
• Task editor opened and canceled without writing data.
• Group Settings General, Members, and Roles tabs rendered correctly.
• Accessible names, tab semantics, disabled states, and table controls were checked.
• Loading, empty, and error states were not exercised because this dependency-only update does not change those flows.
• Mobile layout was not rechecked because this update does not change application UI or CSS.
• Screenshots were not attached because there are no visible UI changes.

Release and Data Safety

• No secrets, cookies, tokens, or private environment values are committed or logged.
• No database schema changes or migration artifacts were made.
• Cloudflare bindings, required secrets, R2, Durable Objects, public routes, and CI gates pass release preflight.
• Auth, authorization, and redirect behavior were not changed.
• Legal, support, SEO, analytics, and public metadata were not changed.

Risks

• Updated TanStack packages emit deprecation warnings for existing createServerFn().inputValidator() calls. The calls remain functional; migrating them is deferred to a focused follow-up.
• pnpm audit reports advisories in deepmerge-ts and mysql2 through Prisma. Both were already present on main; this application uses PostgreSQL, and no unsupported transitive override is introduced here.
• The existing large client chunk warning remains unchanged.

Follow-Ups

• Migrate TanStack server functions from .inputValidator() to .validator() in a focused change.
• Revisit the Prisma transitive advisories when supported upstream releases are available.

[github-actions]

🧪 Pair Research PR Checks

• 🔐 Release preflight: ✅ success
• 🚨 Lint: ✅ success
• 🧪 Unit tests: ✅ success
• 🏗️ Build: ✅ success

🔗 Run: https://github.com/NUDelta/pair-research/actions/runs/35625125872