chore(APP-1014): dependency cleanup — deps refresh, ultracite 7.10, CodeQL

[tyhonchik]

Dependency cleanup per APP-1014 plus the CodeQL backlog. pnpm audit goes 2 → 1 (the known elliptic low with no upstream patch); dedupe, peers, lint, type-check, tests and next build are all green on the final tree. Three commits: everything semantic, the mechanical formatter output, and the blame-ignore entry pointing at it.

Changes

• pnpm up -r across all workspaces, pnpm 11.21 → 11.24 — gov-ui-kit 2.11.2, Next 16.3.2, Sentry 10.71, react-query 5.102, ai 7.0.79, rhf 7.86, user-event 14.6.6. Major taken: deepmerge-ts 7 → 8, closing its high stack-exhaustion advisory (GHSA-ggr8-5vv4-36mx, out of cooldown). Still deliberately held: typescript 5.9, framer-motion 12, changesets 2, jest-dom 6.9.1, @types/node 24, jsdom 29, vercel 58.4.4 + @vercel/oidc 3.8.1 (3.8.2–3.8.5 still ship without provenance), @coinbase/cdp-sdk 1.52.0 (upstream is still the broken 1.55.0). pnpm 11.25 is inside the 7-day cooldown, hence 11.24. The dead autoInstallTypes workspace setting (never a real pnpm option; 11.24 started warning) is dropped.
• Adaptations to in-range upstream behavior changes — gov-ui-kit 2.11.1 rebuilt interactive rows as an overlay link/button with pointer-events-none content, so two click tests now select the row by role; react-query 5.102 removed promise from observer results and rhf 7.86 added getErrors (test generators updated); the AI SDK stopped surfacing merged-stream errors to the outer createUIMessageStream onError, which silently skipped the assistant's failed-turn refund — the refund moved into the model-stream error handler behind an idempotent guard, with logging following the original error.
• New hold: @assistant-ui/tap at 0.9.12 — 0.9.13+ loops forever in its useSyncExternalStore shim under the exact-pinned @assistant-ui/react 0.14.27 and crashes every widget suite. Re-check when the assistant-ui pins move.
• Overrides re-verified — every entry still resolves and every security floor is honored on the current tree. The undocumented isomorphic-dompurify>jsdom: 26.1.0 pin now carries its real reason (jsdom 27+ pulls ESM-only deps Jest cannot parse — verified by lifting it and watching 43 suites fail).
• ultracite 7.8.3 → ^7.10.6 — the exact-pin hold is gone. New preset rules that contradict deliberate house patterns are disabled in biome.json next to the existing offs: noAwaitInLoops (sequential awaits in e2e polling/retry loops are intentional), noJsxPropsBind, noIncrementDecrement, useDestructuring (~26 pre-existing spots — a migration of its own), noUnnecessaryConditions (false positives on RegExp.exec null checks and mutable class fields), and the useSortedKeys assist — the config already declined property sorting under its old name, and alphabetizing object literals reorders built URL query strings (15 tests caught it). Rules kept on are satisfied in code: interface property signatures, { cause } on rethrown errors (UploadFileError forwards ErrorOptions), two test-only fixes. The resulting mechanical reformat is a separate style: commit listed in .git-blame-ignore-revs (now with comments; GitHub picks the file up automatically, locally it is one git config blame.ignoreRevsFile .git-blame-ignore-revs, already documented in the app README).
• sanitize-html hold dropped as redundant — gov-ui-kit 2.11.2 pins sanitize-html to exactly 2.17.5 upstream and is its only consumer, so the workspace override decided nothing. The htmlparser2@12 (ESM) migration stays blocked until the kit unpins; when it does, Jest here needs the sanitize-html/htmlparser2 chain in transformIgnorePatterns before taking the bump.
• CodeQL: 6 open alerts → 0 — the four unpinned-tag alerts are fixed by pinning linear/linear-release-action@v0 to the v0.17.1 commit SHA in the house pin style. The two untrusted-checkout alerts on the release-finalize workflows are dismissed as accepted-by-design with comments: they run only for merged PRs (merging requires write access) from release/* branches, and checking out the tested SHA rather than the merge commit is deliberate — the tag must point at the exact CI-tested commit.
• synpress/playwright dedupe (ticket item 3) — already resolved by the previous deps PR (chore(deps): update dependencies, bump pnpm to 11.21, drop corepack #1324, playwright-core added as a real devDependency); pnpm dedupe --check passes with no peer errors and no ignoreMissing hacks. Verified, nothing to change.

Linear: APP-1014

🤖 Generated with Claude Code

[linear-code]

APP-1014

[github-actions]

🚀 Preview Deployment: View Here
🤖 Assistant Preview: View Here (app preview points at it)

[github-actions]

E2E results (preview)

Smoke

Base URL	https://app-next-bk2d4z9cg-aragon-app.vercel.app
Suite	smoke
Playwright result	✅ passed
Summary	82 passed
HTML report	View report
GitHub job	✅ completed

View run #5111