[dsclassen]

Summary

Dependency sweep across the monorepo. Each commit is self-contained:

1. Minor/patch updates (46 packages): mongoose 9.10, MUI 9.4, React 19.3, react-router 8.4, vite 8.3, axios 1.20, bull-board 9.10, express-rate-limit 8.7, supertest 7.3, turbo 2.11, eslint 10.11, typescript-eslint 8.70, and others.
2. dotenv 17 → 18: v18 removed .env.vault and node -r dotenv/config preloading, which we don't use. I checked import 'dotenv/config' and dotenv.config() at runtime in backend, worker and scoper.
3. Fix: register the mailer template plugin once: every send*Email function called transporter.use('compile', hbs(...)) on the module-level transporter. Each email added another copy of the plugin, and later emails ran the template compile once per earlier send. The plugin is now registered once, next to createTransport, in backend, worker and scoper. All call sites used identical options.
4. vitest 4 → 5 (vitest, @vitest/coverage-v8, @vitest/ui):
   • vitest 5 clears mocks before each test by default. I converted the tests to that model instead of setting clearMocks: false: tests that check import-time behaviour (Redis clients, the mailer transporter and plugin, the scoper entry point) now call vi.resetModules() and import inside the test, with vi.hoisted mocks shared across imports.
   • jest-dom 7.0.1's vitest types augment the old Assertion<T>, which doesn't merge with vitest 5's Assertion<R, T>, so toBeInTheDocument and the other matchers disappeared from tsc (Vitest 5: matcher types are lost — Assertion<T> augmentation no longer merges with Vitest's Assertion<R, T> testing-library/jest-dom#738). apps/ui/src/test/jest-dom-vitest.d.ts augments Matchers<R, T> instead. Delete it once feat: support vitest 5 testing-library/jest-dom#742 is released.
   • rateLimiterKeys.test.ts intermittently hung or failed with socket hang up with this update set: about 15% of isolated runs, versus 51/51 on main. It passed the bare app to supertest, which starts and stops a server for every request. It now listens once per limiter: 30/30 pass.

Held back

Package	Why
typescript 7	typescript-eslint (latest 8.71) supports typescript >=4.8.4 <6.1.0, and TS 7 no longer exports the JS compiler API that typescript-eslint uses.
nodemailer 10	Its bundled types don't accept nodemailer-express-handlebars' plugin type (@types/nodemailer-express-handlebars is built on @types/nodemailer), and that package hasn't been updated since 2024. None of v10's fixes affect us.
jsdom 30.1 (pinned ~30.0.1)	jsdom 30.1 no longer exposes Blob's impl symbol, which vitest's FormData/Blob shim reads, so FormData requests fail in UI tests. It's broken in both vitest 4 and 5.0.2 (vitest-dev/vitest#11336).
bullmq	Updated separately in #1061.

Test plan

• pnpm lint, pnpm build, pnpm test all pass: backend 633, worker 347, scoper 93, ui 1239, md-utils 102, mongodb-schema 3 (+9 skipped)
• rateLimiterKeys.test.ts run 30× in isolation, no failures
• dotenv 18 runtime check in backend/worker/scoper
• Deploy to dev, click through the UI (MUI/React/router bumps), and send one job-complete email

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 602a461

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@bilbomd/backend	Patch
@bilbomd/worker	Patch
@bilbomd/scoper	Patch
@bilbomd/ui	Patch
@bilbomd/md-utils	Patch
@bilbomd/mongodb-schema	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR