deps: merge main dependency bumps into pnpm branch

Merge origin/main and refresh the pnpm lockfile with updates
from Dependabot: @babel/core, vite, dompurify, shell-quote,
js-yaml, and i18next-fs-backend.

Bump vulnerable transitive deps to satisfy dependency review:
tmp 0.2.7, ws ^8.21.0, OpenTelemetry ^2.8.0, yaml ^2.8.3,
postcss ^8.5.10, uuid 11.1.1, brace-expansion 5.0.6, and
testcafe 3.7.5 (drops replicator).

Exempt js-yaml@4.3.0 and OpenTelemetry 2.8.0 packages from
minimumReleaseAge until they mature.

Author: mrTuomoK

apps/events-helsinki/package.json

@@ -152,9 +152,9 @@
     "size-limit": "11.2.0",
     "symlink-dir": "6.0.5",
     "sync-directory": "6.0.5",
-    "testcafe": "^3.7.4",
+    "testcafe": "^3.7.5",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vite-plugin-css-injected-by-js": "3.5.2",
     "vitest": "4.1.2",
     "vitest-axe": "0.1.0",

apps/hobbies-helsinki/package.json

@@ -152,9 +152,9 @@
     "size-limit": "11.2.0",
     "symlink-dir": "6.0.5",
     "sync-directory": "6.0.5",
-    "testcafe": "^3.7.4",
+    "testcafe": "^3.7.5",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vite-plugin-css-injected-by-js": "3.5.2",
     "vitest": "4.1.2",
     "vitest-axe": "0.1.0",

apps/sports-helsinki/package.json

@@ -160,9 +160,9 @@
     "size-limit": "11.2.0",
     "symlink-dir": "6.0.5",
     "sync-directory": "6.0.5",
-    "testcafe": "^3.7.4",
+    "testcafe": "^3.7.5",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vite-plugin-css-injected-by-js": "3.5.2",
     "vitest": "4.1.2",
     "vitest-axe": "0.1.0",

package.json

@@ -91,7 +91,7 @@
     "react-dom": "18.3.1"
   },
   "devDependencies": {
-    "@babel/core": "^7.28.5",
+    "@babel/core": "^7.29.6",
     "@commitlint/cli": "^19.8.1",
     "@commitlint/config-conventional": "^19.8.1",
     "@events-helsinki/eslint-config-bases": "workspace:^",
@@ -127,7 +127,7 @@
     "picocolors": "1.1.1",
     "prettier": "^3.6.2",
     "rimraf": "6.0.1",
-    "shell-quote": "1.8.3",
+    "shell-quote": "1.8.4",
     "ts-loader": "9.5.2",
     "ts-node": "10.9.2",
     "typescript": "5.8.3",

packages/common-tests/package.json

@@ -42,7 +42,7 @@
     "eslint-plugin-testing-library": "^7.16.2",
     "prettier": "^3.6.2",
     "rimraf": "6.0.1",
-    "testcafe": "^3.7.4",
+    "testcafe": "^3.7.5",
     "typescript": "5.8.3",
     "vitest": "4.1.2"
   },

packages/components/package.json

@@ -88,7 +88,7 @@
     "sanitize-html": "^2.17.0"
   },
   "devDependencies": {
-    "@babel/core": "^7.28.5",
+    "@babel/core": "^7.29.6",
     "@babel/preset-env": "^7.28.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
@@ -128,7 +128,7 @@
     "crypto-browserify": "3.12.1",
     "csstype": "3.1.3",
     "dequal": "2.0.3",
-    "dompurify": "3.4.0",
+    "dompurify": "3.4.11",
     "esbuild": "0.28.1",
     "esbuild-sass-plugin": "3.7.0",
     "eslint": "9.39.4",
@@ -154,7 +154,7 @@
     "tsconfig-paths-webpack-plugin": "4.2.0",
     "tsup": "^8.0.0",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vitest": "4.1.2",
     "vitest-axe": "0.1.0",
     "vitest-indexeddb": "0.0.0",

packages/graphql-proxy-server/package.json

@@ -68,7 +68,7 @@
     "ts-loader": "9.5.2",
     "ts-node": "10.9.2",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vitest": "4.1.2",
     "vitest-sonar-reporter": "2.0.4",
     "webpack": "5.104.1",

pnpm-lock.yaml

@@ -5,10 +5,16 @@ packages:
 
 # Only install package versions published at least 7 days ago (City of Helsinki org default)
 minimumReleaseAge: 10080
+# Security/dependabot bumps that lag behind the 7-day gate (see main yarn.lock)
+minimumReleaseAgeExclude:
+  - js-yaml@4.3.0
+  - '@opentelemetry/core@2.8.0'
+  - '@opentelemetry/sdk-trace-base@2.8.0'
+  - '@opentelemetry/resources@2.8.0'
 
 # Moved from package.json (pnpm 11.5+ reads overrides here only)
 overrides:
-  '@babel/core': ^7.28.5
+  '@babel/core': ^7.29.6
   '@babel/runtime': ^7.28.4
   '@testing-library/dom': ^10.4.0
   '@tootallnate/once': ^3.0.1
@@ -33,10 +39,20 @@ overrides:
   socks: ^2.8.6
   svgo@^3.0.2: ^4.0.1
   tar: '>=7.5.4'
-  tmp: 0.2.5
+  tmp: 0.2.7
   underscore: '>=1.13.8'
   typescript: 5.8.3
-  ws: ^8.13.3
+  ws: ^8.21.0
+  js-yaml: 4.3.0
+  i18next-fs-backend: 2.6.6
+  '@opentelemetry/core': ^2.8.0
+  '@opentelemetry/sdk-trace-base': ^2.8.0
+  '@opentelemetry/resources': ^2.8.0
+  'yaml@^2.0.0': ^2.8.3
+  postcss: ^8.5.10
+  'brace-expansion@5.0.5': 5.0.6
+  'uuid@11.1.0': 11.1.1
+  'uuid@^9.0.0': 11.1.1
 
 allowBuilds:
   '@apollo/protobufjs': true

pnpm-workspace.yaml

@@ -63,7 +63,7 @@
     "tsconfig-paths-webpack-plugin": "4.2.0",
     "tsx": "4.20.3",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vitest": "4.1.2",
     "vitest-sonar-reporter": "2.0.4",
     "webpack": "5.104.1",