chore(deps): refresh bun.lock (lock-file maintenance)

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "after 2am and before 3am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0528788

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes changesets to release 2 packages

Name	Type
@checkstack/backend	Patch
@checkstack/frontend	Patch

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	✅ Passed
Security (container)	❌ Failed
E2E	✅ Passed

❌ Security Audit Failures (container / OS)

🔎 Security Audit (container / OS packages)

❌ Fixable vulnerabilities (8) — these fail the build:
  [MEDIUM] libssl3 3.5.7-r0 -> fixed in 3.5.8-r0  (CVE-2026-63076)
  [MEDIUM] libcrypto3 3.5.7-r0 -> fixed in 3.5.8-r0  (CVE-2026-63076)
  [MEDIUM] libssl3 3.5.7-r0 -> fixed in 3.5.8-r0  (CVE-2026-63072)
  [MEDIUM] libcrypto3 3.5.7-r0 -> fixed in 3.5.8-r0  (CVE-2026-63072)
  [MEDIUM] libssl3 3.5.7-r0 -> fixed in 3.5.8-r0  (CVE-2026-18798)
  [MEDIUM] libcrypto3 3.5.7-r0 -> fixed in 3.5.8-r0  (CVE-2026-18798)
  [HIGH] libssl3 3.5.7-r0 -> fixed in 3.5.8-r0  (CVE-2026-14456)
  [HIGH] libcrypto3 3.5.7-r0 -> fixed in 3.5.8-r0  (CVE-2026-14456)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: Only fixable findings (a patched version exists) fail the build; unfixed findings are surfaced as warnings, not gated. Run bun run audit:image to reproduce the production-image scan locally. These are OS/container packages (alpine, openssl, ...) - bump the base image or the apk add set in the Dockerfile. npm dependency findings are handled by the Security (deps) gate above, not here.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	❌ Failed
Lint	✅ Passed
Deps	✅ Passed
Test	❌ Failed
Integration	✅ Passed
Security (deps)	✅ Passed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Typecheck Errors

$ bun run typecheck:references:check && tsgo -b
$ bun run scripts/generate-tsconfig-references.ts --check
⚠️  Pruned 1 back-edges to break dep cycles (packages still typecheck via source-file fallback):
   - @checkstack/satellite-backend → @checkstack/healthcheck-backend
✓ tsconfig references are up to date.
core/automation-frontend/src/editor/ActionEditor.tsx(153,9): error TS2322: Type '({ label: string; icon: "Power" | "PowerOff"; onClick: () => void; } | { label: string; icon: "Copy"; onClick: () => void; } | { label: string; icon: "Trash2"; onClick: () => void; variant: "destructive"; })[]' is not assignable to type 'ActionCardMenuItem[]'.
  Type '{ label: string; icon: "Power" | "PowerOff"; onClick: () => void; } | { label: string; icon: "Copy"; onClick: () => void; } | { label: string; icon: "Trash2"; onClick: () => void; variant: "destructive"; }' is not assignable to type 'ActionCardMenuItem'.
    Type '{ label: string; icon: "Trash2"; onClick: () => void; variant: "destructive"; }' is not assignable to type 'ActionCardMenuItem'.
      Types of property 'icon' are incompatible.
        Type '"Trash2"' is not assignable to type 'IconName | undefined'. Did you mean '"Trash"'?
core/automation-frontend/src/editor/ConditionsEditor.tsx(114,9): error TS2322: Type '({ label: string; icon: "Copy"; onClick: () => void; } | { label: string; icon: "Trash2"; onClick: () => void; variant: "destructive"; })[]' is not assignable to type 'ActionCardMenuItem[]'.
  Type '{ label: string; icon: "Copy"; onClick: () => void; } | { label: string; icon: "Trash2"; onClick: () => void; variant: "destructive"; }' is not assignable to type 'ActionCardMenuItem'.
    Type '{ label: string; icon: "Trash2"; onClick: () => void; variant: "destructive"; }' is not assignable to type 'ActionCardMenuItem'.
      Types of property 'icon' are incompatible.
        Type '"Trash2"' is not assignable to type 'IconName | undefined'. Did you mean '"Trash"'?
core/automation-frontend/src/editor/TriggersEditor.tsx(193,9): error TS2322: Type '({ label: string; icon: "Copy"; onClick: () => void; } | { label: string; icon: "Trash2"; onClick: () => void; variant: "destructive"; })[]' is not assignable to type 'ActionCardMenuItem[]'.
  Type '{ label: string; icon: "Copy"; onClick: () => void; } | { label: string; icon: "Trash2"; onClick: () => void; variant: "destructive"; }' is not assignable to type 'ActionCardMenuItem'.
    Type '{ label: string; icon: "Trash2"; onClick: () => void; variant: "destructive"; }' is not assignable to type 'ActionCardMenuItem'.
      Types of property 'icon' are incompatible.
        Type '"Trash2"' is not assignable to type 'IconName | undefined'. Did you mean '"Trash"'?

How to fix: Run bun run typecheck locally to reproduce these errors. Inspect the reported files and line numbers, then fix all type errors. Do not use any as an explicit type or @ts-ignore to suppress errors. Ensure all function signatures, return types, and variable types are correct.

❌ Test Failures

... (truncated 16105 lines)
::endgroup::

::group::scripts/eslint-rules/no-extraneous-runtime-deps.test.ts:
(pass) no-extraneous-runtime-deps > valid > import { CodeEditor } from "@checkstack/ui/code-editor"; [1.63ms]
(pass) no-extraneous-runtime-deps > valid > import { Button } from "@checkstack/ui"; [1.01ms]
(pass) no-extraneous-runtime-deps > invalid > import x from "totally-not-installed-pkg"; [1.02ms]

::endgroup::

::group::scripts/eslint-rules/no-pod-local-entity-state.test.ts:
(pass) no-pod-local-entity-state > valid > entityPoint.defineEntity({ kind: "incident", state: s, read: createIncidentEntityRead(service) }); [2.69ms]
(pass) no-pod-local-entity-state > valid > defineEntity({ kind: "system", state: s, read: (ids) => createCatalogSystemEntityRead(svc())(ids) }); [1.44ms]
(pass) no-pod-local-entity-state > valid > defineEntity({ kind: "health", state: s, read: (ids) => { const db = x; return createHealthEntityRead({ db, service })(ids); } }); [1.61ms]
(pass) no-pod-local-entity-state > valid > defineEntity({ kind: "k", state: s, read: (ids) => db.select().from(t).where(inArray(t.id, ids)) }); [1.42ms]
(pass) no-pod-local-entity-state > valid > defineEntity({ kind: "k", state: s, read: (ids) => service.getManyEntityStates(ids) }); [1.37ms]
(pass) no-pod-local-entity-state > valid > const readState = (ids) => db.select().from(t); defineEntity({ kind: "k", state: s, read: readState }); [2.00ms]
(pass) no-pod-local-entity-state > valid > defineEntity({ kind: "ws-registry", state: s, read: (ids) => connections.get(ids[0]) }); [1.55ms]
(pass) no-pod-local-entity-state > valid > defineEntity({ kind: "k", state: s, read: opaqueRead }); [1.27ms]
(pass) no-pod-local-entity-state > valid > defineEntity({ kind: "k", state: s, read: (ids) => cache.get(ids[0]) }); [1.39ms]
(pass) no-pod-local-entity-state > valid > someOther({ read: (ids) => cache.get(ids[0]) }); [1.12ms]
(pass) no-pod-local-entity-state > invalid > const m = new Map(); defineEntity({ kind: "k", state: s, read: (ids) => ids.map((id) => m.get(id)) }); [1.71ms]
(pass) no-pod-local-entity-state > invalid > defineEntity({ kind: "k", state: s, read: (ids) => connections.get(ids[0]) }); [1.53ms]
(pass) no-pod-local-entity-state > invalid > defineEntity({ kind: "k", state: s, read: (ids) => { const store = new Map(); return store; } }); [1.76ms]
(pass) no-pod-local-entity-state > invalid > defineEntity({ kind: "k", state: s, read: importedOpaqueRead }); [1.06ms]
(pass) no-pod-local-entity-state > invalid > defineEntity({ kind: "k", state: s, read: (ids) => mysteryFetch(ids) }); [1.39ms]
(pass) no-pod-local-entity-state > invalid > defineEntity({ kind: "k", state: s, read: (ids) => { db.select(); return cache.get(ids[0]); } }); [1.75ms]

::endgroup::

::group::scripts/eslint-rules/no-direct-system-status-read.test.ts:
(pass) no-direct-system-status-read > valid > const s = await cache.read(systemId); [1.67ms]
(pass) no-direct-system-status-read > valid > const s = await cache.readBulk(ids); [0.74ms]
(pass) no-direct-system-status-read > valid > os.getSystemHealthStatus.handler(async () => cache.read(id)); [0.82ms]
(pass) no-direct-system-status-read > valid > service.getSystemEnvironmentIds(systemId); [0.75ms]
(pass) no-direct-system-status-read > valid > service.getSystemHealthStatus(systemId); [0.64ms]
(pass) no-direct-system-status-read > invalid > const s = await service.getSystemHealthStatus(systemId); [1.07ms]
(pass) no-direct-system-status-read > invalid > const s = await service.getSystemHealthStatus(systemId, envId); [0.94ms]
(pass) no-direct-system-status-read > invalid > const s = await this.getSystemHealthStatus(systemId); [0.97ms]

::endgroup::

::group::scripts/eslint-rules/prefer-gated-mutation.test.ts:
(pass) prefer-gated-mutation > valid > const m = client.updateAutomation.useGatedMutation({}); [1.06ms]
(pass) prefer-gated-mutation > valid > const q = client.listAutomations.useGatedQuery(); [0.85ms]
(pass) prefer-gated-mutation > valid > const m = useMutation({ mutationFn }); [0.90ms]
(pass) prefer-gated-mutation > valid > const m = foo.useMutation({}); [1.00ms]
(pass) prefer-gated-mutation > valid > const q = client.listAutomations.useQuery(); [0.74ms]
(pass) prefer-gated-mutation > invalid > const m = client.updateAutomation.useMutation({}); [0.99ms]
(pass) prefer-gated-mutation > invalid > const m = api.automation.client.createAutomation.useMutation({}); [1.03ms]
(pass) prefer-gated-mutation > invalid > const m = client.deleteAutomation.useMutation(); [0.90ms]

::endgroup::

::group::scripts/eslint-rules/no-direct-health-run-insert.test.ts:
(pass) no-direct-health-run-insert > valid > db.select().from(schema.healthCheckRuns).where(c); [0.86ms]
(pass) no-direct-health-run-insert > valid > db.insert(schema.healthCheckConfigurations).values(row); [0.86ms]
(pass) no-direct-health-run-insert > valid > map.insert(key, value); [0.80ms]
(pass) no-direct-health-run-insert > valid > tx.insert(schema.healthCheckRuns).values(row); [0.71ms]
(pass) no-direct-health-run-insert > invalid > await tx.insert(schema.healthCheckRuns).values({ systemId }); [0.82ms]
(pass) no-direct-health-run-insert > invalid > await db.insert(healthCheckRuns).values(row); [1.00ms]

::endgroup::

::group::scripts/eslint-rules/no-unmanaged-entity-state.test.ts:
(pass) no-unmanaged-entity-state > valid > const h = createHook("notification.delivered"); [3.22ms]
(pass) no-unmanaged-entity-state > valid > const h = createHook("incident.created"); [0.81ms]
(pass) no-unmanaged-entity-state > valid > const h = createHook("auth.user.deleted"); [0.82ms]
(pass) no-unmanaged-entity-state > valid > const h = createHook(buildId()); [0.88ms]
(pass) no-unmanaged-entity-state > valid > db.update(incidents).set({ status: "open" }); [0.91ms]
(pass) no-unmanaged-entity-state > valid > db.update(incidents).set({ status: "open" }); [4.56ms]
(pass) no-unmanaged-entity-state > valid > db.update(incidents).set({ title: "x" }); [1.17ms]
(pass) no-unmanaged-entity-state > valid > cache.update(incidents).set({ status: "open" }); [1.01ms]
(pass) no-unmanaged-entity-state > invalid > const h = createHook("incident.created"); [1.06ms]
(pass) no-unmanaged-entity-state > invalid > const h = createHook("incident.updated"); [1.30ms]
(pass) no-unmanaged-entity-state > invalid > const h = createHook("catalog.system.deleted"); [1.23ms]
(pass) no-unmanaged-entity-state > invalid > const h = createHook("healthcheck.system.health_changed"); [1.15ms]
(pass) no-unmanaged-entity-state > invalid > const h = createHook("incident.resolved"); [1.10ms]
(pass) no-unmanaged-entity-state > invalid > const h = api.createHook("maintenance.updated"); [1.01ms]
(pass) no-unmanaged-entity-state > invalid > db.update(incidents).set({ status: "resolved" }); [1.23ms]
(pass) no-unmanaged-entity-state > invalid > tx.insert(incidents).values({ status: "open", title: "x" }); [0.99ms]

::endgroup::

::group::scripts/eslint-rules/no-inline-detail-card-chrome.test.ts:
(pass) no-inline-detail-card-chrome > valid > const el = <DetailCard className="overflow-hidden">x</DetailCard>; [1.16ms]
(pass) no-inline-detail-card-chrome > valid > const cls = cn(detailCardSurface, "overflow-hidden"); [0.58ms]
(pass) no-inline-detail-card-chrome > valid > const el = <div className="rounded-lg border border-border bg-card">x</div>; [0.87ms]
(pass) no-inline-detail-card-chrome > valid > const el = <div className="rounded-md bg-surface-inset p-2">x</div>; [0.78ms]
(pass) no-inline-detail-card-chrome > invalid > const el = <div className="rounded-[var(--d-card-r)] border border-border/70 bg-card">x</div>; [1.02ms]
(pass) no-inline-detail-card-chrome > invalid > const el = <div className="border bg-gradient-to-b from-surface-2 to-surface">x</div>; [0.78ms]
(pass) no-inline-detail-card-chrome > invalid > const SHADOW = "shadow-[0_1px_2px_hsl(var(--foreground)/0.04),0_10px_30px_-14px_hsl(var(--foreground)/0.12)]"; [0.70ms]
(pass) no-inline-detail-card-chrome > invalid > const el = <div className={`rounded-[var(--d-card-r)] border ${PANEL_SHADOW}`}>x</div>; [1.10ms]

::endgroup::

 317 pass
 0 fail
 440 expect() calls
Ran 317 tests across 23 files. [867.00ms]

How to fix: Run bun test locally to reproduce these failures. Read the failing test assertions carefully and fix the implementation code so the tests pass. Do not modify test expectations unless the test itself is clearly wrong. If a test is testing new functionality you introduced, make sure your implementation satisfies the test's contract.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.