chore(deps): consolidate compatible dependency updates and security fixes

[swernerx]

Dependency group

This PR consolidates the currently compatible direct dependency updates into one repository-wide maintenance change.

Runtime dependencies

• @sindresorhus/slugify 3.0.0 -> 3.0.1
• better-sqlite3 12.11.1 -> 13.0.3
• chalk 5.6.2 -> 6.0.0
• execa 10.0.0 -> 10.0.1
• ky 2.0.2 -> 2.1.0
• p-retry 8.0.0 -> 8.0.1
• playwright 1.61.1 -> 1.63.0
• zod 4.4.3 -> 4.6.5

Development and test tooling

• Commitlint 21.2.1/21.2.0 -> 21.2.3
• @types/better-sqlite3 7.6.13 -> 9.6.0
• @types/node 26.1.1 -> 26.6.2
• Vitest and @vitest/coverage-v8 4.1.10 -> 5.0.1
• ESLint 10.7.0 -> 10.11.0
• lint-staged 17.0.8 -> 17.5.1
• Prettier 3.9.5 -> 3.9.8
• tsx 4.23.1 -> 4.23.15
• typescript-eslint 8.64.0 -> 8.70.0

Upstream changes that matter here

• better-sqlite3 13.0.0 moves the native binding to Node-API and removes the deprecated prebuild-install dependency. The project already targets Node 22+, and the existing database API usage type-checks and tests unchanged.
• chalk 6.0.0 requires Node 22, which matches the package engine and CI matrix. Existing color API usage needs no migration.
• Vitest 5.0.1 is updated together with the matching coverage adapter. The existing Node test environment, snapshot setup, and coverage configuration remain valid.
• Playwright 1.63.0 adds locator, trace, and test-runner improvements; no affected API or configuration is used locally.
• typescript-eslint 8.70.0 remains compatible with the repository's TypeScript 6.0.3 and ESLint 10 setup.

Security fixes

The initial pnpm audit reported 13 advisories (10 high, 3 moderate). The updated lockfile now reports zero vulnerabilities. In addition to parent-package updates, the existing pnpm override section pins compatible patched transitive versions:

• fast-uri -> 3.1.8 for the conf/AJV and Commitlint paths (GHSA-v2hh-gcrm-f6hx, GHSA-f65p-4m7j-42xc)
• postcss -> 8.5.28 and nanoid -> 3.3.19 for the Vitest/Vite path (GHSA-fxqj-rqcc-2cmp, GHSA-2v37-7h3g-55p8)

Local impact and deferred work

• No application source migration was required; imports, configuration, snapshots, and CLI usage remain unchanged.
• TypeScript stays at 6.0.3 for now. TypeScript 7.0.2 is not included because [email protected] declares a peer range below TypeScript 6.1.0. The existing TypeScript 7 Renovate PR should remain a separate follow-up.
• Existing automated PRs for better-sqlite3 13 and Playwright 1.63 overlap with this consolidated update.

Validation

• pnpm install --frozen-lockfile: passed
• pnpm check: passed (format, lint, typecheck, 54 test files / 667 tests, build)
• pnpm test:integration: passed (5/5)
• pnpm audit --json: passed (0 vulnerabilities)
• git diff --check: passed

Risk

The main compatibility surface is the major update of better-sqlite3, Chalk, and Vitest. Node 22+ is already enforced by the package engine and exercised by CI; the local unit, integration, typecheck, lint, format, and build checks all pass.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.74%. Comparing base (ecec1b6) to head (d82cc75).
⚠️ Report is 1 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #134      +/-   ##
==========================================
+ Coverage   48.78%   50.74%   +1.96%     
==========================================
  Files          52       53       +1     
  Lines        5947     6010      +63     
  Branches     1777     1752      -25     
==========================================
+ Hits         2901     3050     +149     
+ Misses       3044     2958      -86     
  Partials        2        2              

see 9 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.