Bumped dependencies.

[przemyslaw-zan]

🚀 Summary

A brief summary of what this PR changes.

---

📌 Related issues

• Closes #000

---

💡 Additional information

Optional: Notes on decisions, edge cases, or anything helpful for reviewers.

---

Note

Medium Risk
Lockfile-only dependency bumps (notably rollup/webpack and their plugin ecosystems) can change build/test output across packages despite no code changes. Added version overrides may also affect downstream resolution behavior across the workspace.

Overview
Updates workspace dependency resolution and lockfile to newer versions across the toolchain, including rollup 4.52.4 → 4.59.0 and webpack 5.101.1 → 5.105.2, plus associated loaders/plugins.

Adjusts pnpm overrides in pnpm-workspace.yaml/pnpm-lock.yaml to pin ranges for diff@^7, minimatch@^9, and qs@^6, and refreshes numerous transitive packages accordingly.

^{Written by Cursor Bugbot for commit 489ce0f. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is kicking off a free Cloud Agent to fix this issue. This run is complimentary, but you can enable autofix for all future PRs in the Cursor dashboard.}

[cursor]

Minimatch brace-expansion upgrade may alter glob behavior

Medium Severity

minimatch@9.0.6 now depends on brace-expansion@5.0.3 instead of brace-expansion@2.0.2 used by prior minimatch 9.x. That spans three major versions of brace-expansion, which can change how brace patterns like *.{js,ts} or src/{a,b}/file are expanded. This may affect glob matching used by editorconfig, mocha, glob@10, @typescript-eslint/typescript-estree, and @tufjs/models—e.g. in .editorconfig sections, test discovery, or config path patterns.

Additional Locations (1)

• pnpm-lock.yaml#L4273-L4276

 

[cursor]

Bugbot Autofix determined this is a false positive.

Comparing minimatch 9.0.5 and 9.0.6 across brace-heavy glob patterns used by this repository showed no matching differences, so no code change is required.

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}