build(deps): consolidate 12 dependabot bumps

.github/workflows/gym.yml

@@ -60,7 +60,7 @@ jobs:
         run: npm install -g node-gyp@11
 
       - name: Cache pnpm store
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.local/share/pnpm/store
           key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
@@ -90,7 +90,7 @@ jobs:
       - name: Cache scip-go binary
         if: matrix.language == 'go'
         id: cache-scip-go
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/go/bin
           key: scip-go-${{ runner.os }}-${{ env.SCIP_GO_VERSION }}
@@ -121,7 +121,7 @@ jobs:
 
       - name: Cache cargo registry
         if: matrix.language == 'rust'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index
@@ -133,7 +133,7 @@ jobs:
 
       - name: Cache pip wheels
         if: matrix.language == 'python'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/pip
           key: pip-${{ runner.os }}-${{ hashFiles('packages/gym/corpus/repos/python/**/pyproject.toml', 'packages/gym/corpus/repos/python/**/requirements*.txt') }}
@@ -189,7 +189,7 @@ jobs:
 
       - name: Comment gate summary on PR regression
         if: github.event_name == 'pull_request' && failure() && steps.gym-run.outcome == 'failure'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('node:fs');
@@ -264,7 +264,7 @@ jobs:
         run: npm install -g node-gyp@11
 
       - name: Cache pnpm store
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.local/share/pnpm/store
           key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

.github/workflows/release-please.yml

@@ -12,7 +12,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
         with:
           config-file: .release-please-config.json
           manifest-file: .release-please-manifest.json

.gitignore

@@ -40,4 +40,3 @@ examples/fixtures/**/.codehub/
 
 # Astro build cache
 packages/docs/.astro/
-.gitnexus

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.12/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.4.13/schema.json",
   "root": true,
   "files": {
     "includes": [

package.json

@@ -24,10 +24,10 @@
     "commit": "cz"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.4.12",
-    "@commitlint/cli": "20.5.0",
+    "@biomejs/biome": "2.4.13",
+    "@commitlint/cli": "20.5.3",
     "@commitlint/config-conventional": "20.5.0",
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "commitizen": "4.3.1",
     "cz-conventional-changelog": "3.3.0",
     "lefthook": "2.1.6",

packages/analysis/package.json

@@ -19,7 +19,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@aws-sdk/client-bedrock-runtime": "3.1035.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1040.0",
     "@iarna/toml": "2.2.5",
     "@opencodehub/core-types": "workspace:*",
     "@opencodehub/sarif": "workspace:*",
@@ -28,7 +28,7 @@
     "write-file-atomic": "7.0.1"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "@types/write-file-atomic": "4.0.3",
     "typescript": "6.0.3"
   }

packages/cli/package.json

@@ -34,7 +34,7 @@
     "yaml": "2.8.3"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "@types/write-file-atomic": "4.0.3",
     "typescript": "6.0.3"
   }

packages/cli/src/commands/context.ts

@@ -41,7 +41,11 @@ interface ResolvedNode {
 }
 
 type Resolution =
-  | { readonly kind: "resolved"; readonly target: ResolvedNode; readonly alternates: readonly ResolvedNode[] }
+  | {
+      readonly kind: "resolved";
+      readonly target: ResolvedNode;
+      readonly alternates: readonly ResolvedNode[];
+    }
   | { readonly kind: "ambiguous"; readonly candidates: readonly ResolvedNode[] }
   | { readonly kind: "not_found" };
 

packages/core-types/package.json

@@ -21,7 +21,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }

packages/docs/package.json

@@ -18,8 +18,8 @@
   },
   "dependencies": {
     "@astrojs/starlight": "^0.38.4",
-    "astro": "^6.1.9",
-    "sharp": "^0.34.1"
+    "astro": "^6.2.1",
+    "sharp": "^0.34.5"
   },
   "devDependencies": {
     "starlight-links-validator": "^0.24.0",

packages/embedder/package.json

@@ -27,7 +27,7 @@
     "onnxruntime-node": "1.24.3"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }

packages/gym/package.json

@@ -35,7 +35,7 @@
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }

packages/ingestion/package.json

@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@aws-sdk/client-bedrock-runtime": "3.1035.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1040.0",
     "@cyclonedx/cyclonedx-library": "10.0.0",
     "@graphty/algorithms": "1.7.1",
     "@iarna/toml": "2.2.5",
@@ -32,7 +32,7 @@
     "@opencodehub/scip-ingest": "workspace:*",
     "@opencodehub/storage": "workspace:*",
     "@opencodehub/summarizer": "workspace:*",
-    "fast-xml-parser": "5.7.1",
+    "fast-xml-parser": "5.7.2",
     "graphology": "0.26.0",
     "graphology-dag": "0.4.1",
     "piscina": "5.1.4",
@@ -57,15 +57,15 @@
     "write-file-atomic": "7.0.1"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "@types/spdx-correct": "^3.1.3",
     "@types/write-file-atomic": "4.0.3",
-    "ajv": "8.18.0",
+    "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "ajv-formats-draft2019": "1.6.1",
     "typescript": "6.0.3"
   },
   "optionalDependencies": {
-    "ts-morph": "^25.0.1"
+    "ts-morph": "^28.0.0"
   }
 }

packages/mcp/package.json

@@ -31,7 +31,7 @@
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }

packages/sarif/package.json

@@ -28,7 +28,7 @@
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }

packages/scanners/package.json

@@ -22,7 +22,7 @@
     "@opencodehub/sarif": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }

packages/scip-ingest/package.json

@@ -22,11 +22,11 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@bufbuild/protobuf": "2.11.0",
+    "@bufbuild/protobuf": "2.12.0",
     "@opencodehub/core-types": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }

packages/scip-ingest/src/derive.test.ts

@@ -33,12 +33,7 @@
   assert.ok(addCalls.length > 0, "add() should have incoming edges");
 });
 
-function range(
-  startLine: number,
-  startChar: number,
-  endLine: number,
-  endChar: number,
-): ScipRange {
+function range(startLine: number, startChar: number, endLine: number, endChar: number): ScipRange {
   return { startLine, startChar, endLine, endChar };
 }
 
@@ -96,13 +91,14 @@
 
   const calleeEdges = deriveEdges(docA).filter((e) => e.callee === fooB);
   assert.equal(calleeEdges.length, 1, "callerA calls fooB exactly once");
   const resolved = defs.get(calleeEdges[0]!.callee);
   assert.equal(resolved?.file, "src/b.ts");
   assert.equal(resolved?.line, 5);
 });
 
 test("buildSymbolDefIndex: aliases a src-shape def under its dist-shape cross-package descriptor", () => {
-  const srcSymbol = "scip-typescript npm @opencodehub/analysis 0.1.0 src/`verdict.ts`/computeVerdict().";
+  const srcSymbol =
+    "scip-typescript npm @opencodehub/analysis 0.1.0 src/`verdict.ts`/computeVerdict().";
   const distSymbol =
     "scip-typescript npm @opencodehub/analysis 0.1.0 dist/`verdict.d.ts`/computeVerdict().";
 
@@ -158,15 +154,11 @@
   const inner = "local 42";
   const callee = "scip-typescript npm pkg 1.0 src/b.ts/externalCallee().";
 
-  const d = doc("src/a.ts", [
-    defOcc(outer, 10, 30),
-    defOcc(inner, 15, 25),
-    refOcc(callee, 20, 4),
-  ]);
+  const d = doc("src/a.ts", [defOcc(outer, 10, 30), defOcc(inner, 15, 25), refOcc(callee, 20, 4)]);
 
   const edges = deriveEdges(d);
   assert.equal(edges.length, 1, "expected exactly one derived edge");
   assert.equal(edges[0]!.caller, outer);
   assert.equal(edges[0]!.callee, callee);
   assert.equal(edges[0]!.kind, "CALLS");
 });

packages/search/package.json

@@ -23,7 +23,7 @@
     "@opencodehub/storage": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }

packages/storage/package.json

@@ -23,7 +23,7 @@
     "@opencodehub/core-types": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }

packages/summarizer/package.json

@@ -22,11 +22,11 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@aws-sdk/client-bedrock-runtime": "3.1035.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1040.0",
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@types/node": "24.12.2",
+    "@types/node": "25.6.0",
     "typescript": "6.0.3"
   }
 }