P1: Roll all open Dependabot PRs into one verified dependency update

[jusso-dev]

Goal

Consolidate every currently open Dependabot pull request into one reviewable, tested dependency update on main, then close the superseded Dependabot PRs with links to the landed rollup.

Required workflow

1. Inventory all open Dependabot PRs, including package, lockfile, GitHub Action, Docker, and indirect dependency changes.
2. Record current versions, proposed versions, release notes, security advisories, breaking changes, runtime/toolchain constraints, and whether PRs overlap.
3. Create one dedicated rollup branch from current main.
4. Apply upgrades deliberately to manifests and regenerate the pnpm lockfile once. Do not merge Dependabot branches blindly or combine unrelated user work.
5. Resolve peer/runtime constraints using supported versions for Node 24/current LTS, Next.js 16, React 19, Drizzle, Better Auth, BullMQ, Playwright, and the rest of the declared stack.
6. Update code/config/migrations where a dependency requires it.
7. Run the complete verification suite locally and in GitHub Actions.
8. Review the final diff for unexpected install scripts, new transitive packages, licence changes, supply-chain risk, action pin drift, and accidental lockfile churn.
9. Merge the single rollup to main only after required checks pass.
10. Close every superseded Dependabot PR with a comment linking the rollup commit/PR; leave none silently abandoned.
11. Confirm the public amd64 GHCR image is rebuilt successfully from the merged commit.

Guardrails

• Do not bypass branch protection, required reviews, failed checks, or security policy.
• Do not use force-push on main.
• Keep GitHub Actions pinned by full commit SHA.
• Preserve reproducible pnpm installs and the repository package-manager version.
• Do not combine feature work beyond compatibility fixes required by these upgrades.
• If one upgrade is unsafe or blocked, document and exclude it from the rollup instead of weakening tests.
• Security-sensitive major updates require explicit migration notes and targeted tests.

Acceptance criteria

• Issue/PR contains a complete table of all Dependabot PRs and their disposition.
• One clean rollup branch/PR contains the approved dependency changes.
• pnpm install with frozen lockfile succeeds.
• Lint, typecheck, unit, integration, Playwright, build, migration verification, dependency audit, CodeQL, SBOM, licence, and container scan checks pass.
• Docker Compose clean-install smoke test passes on linux/amd64.
• Public GHCR image builds and has the expected amd64 manifest.
• Rollup is merged to main through normal protections.
• All superseded Dependabot PRs are closed with traceable comments; intentionally deferred upgrades have a follow-up issue.
• README/operations notes change only if prerequisites or commands actually changed.

Verification evidence

Attach exact test commands, CI run links, image digest, docker buildx imagetools inspect output, and the closed-PR mapping.

Dependency/order

Do this from a stable main after the current overnight implementation lands, to avoid mixing its feature diff with dependency churn.

[jusso-dev]

Post-merge verification is complete.

• Rollup PR: chore(deps): roll up safe dependency updates #35
• Squash commit: a37ea8841ab176092d98f4d5511bd6368bbb7eb9
• Main CI: https://github.com/jusso-dev/Muster/actions/runs/30232896787
• Main security/supply-chain: https://github.com/jusso-dev/Muster/actions/runs/30232896758
• Published image: ghcr.io/jusso-dev/muster:sha-a37ea88
• Deployed image ID: sha256:75ebdad962373ff1fa5dbef8dba8f0a005de6058e21655dad8c72b1129e90861
• Homelab web, worker, and agent gateway are healthy with zero restarts.
• Pre-deploy PostgreSQL backup: /home/justinmiddler/muster/backups/issue24-pre-a37ea88-20260727T0245Z.dump
• Backup SHA-256: 8606b0e09bdb110016c4e16c17c7a17c9ea92e2f4c7a0bea2f53ed256e49c005
• Data counts matched before/after deployment; authenticated deployed Playwright passed durable message and governed-evidence send/reload (2/2).
• The port-3010 handbook is updated and live.

Dependabot PRs #2–#7 are closed with traceable rollup comments. Node 26 PRs #1 and #8 remain intentionally open under #34.