chore(APP-1014): dependency cleanup — deps refresh, ultracite 7.10, CodeQL

.agents/shared/metrics/hits.jsonl

@@ -223,3 +223,8 @@
 {"ts":"2026-09-02T15:06:32.738Z","tool":"Edit","file":"apps/app/src/shared/utils/notFoundUtils/notFoundUtils.test.ts","rule":"test-scope-and-selectors","bytes":1727,"elapsed_ms":1,"adapter":"claude"}
 {"ts":"2026-09-02T15:07:11.649Z","tool":"Edit","file":"apps/app/src/modules/governance/utils/governanceMetadataUtils/governanceMetadataUtils.ts","rule":"error-and-monitoring","bytes":2525,"elapsed_ms":1,"adapter":"claude"}
 {"ts":"2026-09-02T15:07:20.587Z","tool":"Edit","file":"apps/app/src/modules/application/utils/applicationMetadataUtils/applicationMetadataUtils.ts","rule":"error-and-monitoring","bytes":2525,"elapsed_ms":1,"adapter":"claude"}
+{"ts":"2026-09-01T10:08:57.936Z","tool":"Edit","file":"apps/app/src/modules/finance/components/transactionList/transactionList.test.tsx","rule":"test-scope-and-selectors","bytes":1727,"elapsed_ms":3,"adapter":"claude"}
+{"ts":"2026-09-01T10:09:00.131Z","tool":"Edit","file":"apps/app/src/modules/finance/components/assetAddressSelect/assetAddressSelectAddAddressView.test.tsx","rule":"test-scope-and-selectors","bytes":1727,"elapsed_ms":1,"adapter":"claude"}
+{"ts":"2026-09-01T10:32:14.314Z","tool":"Edit","file":"apps/app/src/shared/utils/pendingTransactionManager/pendingTransactionManager.test.ts","rule":"test-scope-and-selectors","bytes":1727,"elapsed_ms":1,"adapter":"claude"}
+{"ts":"2026-09-02T14:54:16.220Z","tool":"Edit","file":"apps/app/src/actions/core/createProposal/createProposalActionDetails.tsx","rule":"core-action-decoded-input","bytes":948,"elapsed_ms":1,"adapter":"claude"}
+{"ts":"2026-09-02T14:54:23.180Z","tool":"Edit","file":"apps/app/src/actions/crossChainController/components/crossChainControllerForwardMessageDetails/crossChainControllerForwardMessageDetails.tsx","rule":"core-action-decoded-input","bytes":948,"elapsed_ms":1,"adapter":"claude"}

.changeset/app-1014-deps-update-app.md

@@ -0,0 +1,6 @@
+---
+"@aragon/app": patch
+"@aragon/assistant-chat": patch
+---
+
+Update dependencies (gov-ui-kit 2.11.2, next 16.3.2, Sentry 10.71, react-query 5.102, deepmerge-ts 8 closing its stack-exhaustion advisory), bump pnpm to 11.24, and hold the @assistant-ui/tap transitive at 0.9.12 — 0.9.13+ loops forever under the exact-pinned @assistant-ui/react 0.14.27.

.changeset/app-1014-deps-update-assistant.md

@@ -0,0 +1,5 @@
+---
+"@aragon/assistant": patch
+---
+
+Update dependencies (ai 7.0.79, Sentry 10.71, hono 4.13.4) and move the failed-turn refund into the model-stream error handler: the AI SDK now converts merged-stream errors into error parts before they reach the outer stream callback, which silently skipped the refund.

.git-blame-ignore-revs

@@ -1,2 +1,10 @@
+# Bulk mechanical commits hidden from git blame (one full hash per line).
+# GitHub picks this file up automatically; locally, run once:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+
+# chore(APP-315): Implement Biome toolchain (#920)
 3b3d17d0e45057fb2451a7ccad01193c5a69105e
+# chore: move app into apps/app (pure rename, no content changes)
 2b2cfe1ff84efb2f3f99bb6d46d708ea5f298adf
+# style(APP-1014): apply the ultracite 7.10 formatter
+bb9dbdd9b177af4995c76adbed8a7b4a7e236481

.github/workflows/app-production.yml

@@ -186,7 +186,7 @@ jobs:
       - name: Linear — complete release
         if: steps.secrets.outputs.LINEAR_PIPELINE_ACCESS_KEY != ''
         continue-on-error: true
-        uses: linear/linear-release-action@v0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1 (https://github.com/linear/linear-release-action/releases/tag/v0.17.1)
         with:
           access_key: ${{ steps.secrets.outputs.LINEAR_PIPELINE_ACCESS_KEY }}
           command: complete

.github/workflows/app-release-pr-cancel.yml

@@ -64,7 +64,7 @@ jobs:
         id: linear-cancel
         if: steps.version.outputs.name != '' && steps.secrets.outputs.LINEAR_PIPELINE_ACCESS_KEY != ''
         continue-on-error: true
-        uses: linear/linear-release-action@v0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1 (https://github.com/linear/linear-release-action/releases/tag/v0.17.1)
         with:
           access_key: ${{ steps.secrets.outputs.LINEAR_PIPELINE_ACCESS_KEY }}
           command: update

.github/workflows/app-release-start.yml

@@ -152,7 +152,7 @@ jobs:
       - name: Linear — sync release & link issues
         if: steps.load-secrets.outputs.LINEAR_PIPELINE_ACCESS_KEY != ''
         continue-on-error: true
-        uses: linear/linear-release-action@v0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1 (https://github.com/linear/linear-release-action/releases/tag/v0.17.1)
         with:
           access_key: ${{ steps.load-secrets.outputs.LINEAR_PIPELINE_ACCESS_KEY }}
           command: sync
@@ -162,7 +162,7 @@ jobs:
       - name: Linear — set stage to in_progress
         if: steps.load-secrets.outputs.LINEAR_PIPELINE_ACCESS_KEY != ''
         continue-on-error: true
-        uses: linear/linear-release-action@v0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1 (https://github.com/linear/linear-release-action/releases/tag/v0.17.1)
         with:
           access_key: ${{ steps.load-secrets.outputs.LINEAR_PIPELINE_ACCESS_KEY }}
           command: update

apps/app/package.json

@@ -1,32 +1,46 @@
 {
     "name": "@aragon/app",
     "version": "1.38.0",
+    "private": true,
     "description": "Human-centered DAO infrastructure",
-    "author": "Aragon Association",
+    "keywords": [
+        "aragon",
+        "dao",
+        "react",
+        "nextjs",
+        "tailwind"
+    ],
     "homepage": "https://github.com/aragon/app#readme",
-    "private": true,
+    "bugs": {
+        "url": "https://github.com/aragon/app/issues"
+    },
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/aragon/app.git"
+    },
     "license": "GPL-3.0",
+    "author": "Aragon Association",
     "scripts": {
-        "dev": "cross-env pnpm run setup local && next dev",
         "build": "NODE_OPTIONS=--max-old-space-size=6144 next build",
         "build:analyze": "next experimental-analyze",
-        "start": "next start",
-        "test": "jest",
-        "test:changed": "jest --ci --passWithNoTests --changedSince=\"$(git merge-base HEAD origin/main 2>/dev/null || echo main)\"",
-        "test:watch": "jest --watch",
-        "test:coverage": "jest --coverage",
-        "lint": "biome check --write --no-errors-on-unmatched --files-ignore-unknown=true",
-        "lint:check": "biome check --no-errors-on-unmatched --files-ignore-unknown=true",
-        "type-check": "tsc --noEmit",
-        "setup": "./scripts/setupEnv.sh",
+        "dev": "cross-env pnpm run setup local && next dev",
         "e2e": "playwright test --config e2e/playwright.config.ts",
-        "e2e:ui": "playwright test --config e2e/playwright.config.ts --ui",
-        "e2e:smoke": "playwright test --config e2e/playwright.config.ts e2e/tests/smoke",
         "e2e:bv": "playwright test --config e2e/playwright.bv.config.ts e2e/tests/bv/treasuryWithdrawal.spec.ts",
         "e2e:bv:stg": "E2E_BASE_URL=${E2E_BASE_URL:-https://stg.app.aragon.org} playwright test --config e2e/playwright.bv.config.ts e2e/tests/bv/treasuryWithdrawal.spec.ts",
         "e2e:bv:wallet-cache": "pnpm exec synpress e2e/setup --force && node e2e/scripts/syncWalletSetupCache.mjs",
+        "e2e:codegen": "playwright codegen --config e2e/playwright.config.ts",
         "e2e:install": "playwright install --with-deps chromium",
-        "e2e:codegen": "playwright codegen --config e2e/playwright.config.ts"
+        "e2e:smoke": "playwright test --config e2e/playwright.config.ts e2e/tests/smoke",
+        "e2e:ui": "playwright test --config e2e/playwright.config.ts --ui",
+        "lint": "biome check --write --no-errors-on-unmatched --files-ignore-unknown=true",
+        "lint:check": "biome check --no-errors-on-unmatched --files-ignore-unknown=true",
+        "setup": "./scripts/setupEnv.sh",
+        "start": "next start",
+        "test": "jest",
+        "test:changed": "jest --ci --passWithNoTests --changedSince=\"$(git merge-base HEAD origin/main 2>/dev/null || echo main)\"",
+        "test:coverage": "jest --coverage",
+        "test:watch": "jest --watch",
+        "type-check": "tsc --noEmit"
     },
     "dependencies": {
         "@aragon/aragon-domain": "^0.3.1",
@@ -42,23 +56,23 @@
         "@reown/appkit": "^1.8.23",
         "@reown/appkit-adapter-wagmi": "^1.8.23",
         "@reown/walletkit": "^1.5.6",
-        "@sentry/core": "^10.70.0",
-        "@sentry/nextjs": "^10.70.0",
+        "@sentry/core": "^10.71.0",
+        "@sentry/nextjs": "^10.71.0",
         "@tanstack/react-query": "catalog:",
-        "@tanstack/react-query-devtools": "^5.101.4",
+        "@tanstack/react-query-devtools": "^5.102.3",
         "@vercel/analytics": "^2.0.1",
         "@vercel/speed-insights": "^2.0.0",
         "@walletconnect/core": "^2.23.10",
         "@walletconnect/utils": "^2.23.10",
-        "@xyflow/react": "^12.11.2",
+        "@xyflow/react": "^12.11.3",
         "classnames": "catalog:",
-        "deepmerge-ts": "^7.1.6",
+        "deepmerge-ts": "^8.0.2",
         "framer-motion": "^12.43.0",
         "import-in-the-middle": "^3.3.3",
-        "isomorphic-dompurify": "^3.22.0",
+        "isomorphic-dompurify": "^3.23.0",
         "jsdom": "^29.1.1",
         "luxon": "^3.7.2",
-        "next": "^16.3.0",
+        "next": "^16.3.2",
         "nextjs-toploader": "^3.9.17",
         "react": "catalog:",
         "react-dom": "catalog:",
@@ -84,7 +98,7 @@
         "@testing-library/react": "catalog:",
         "@testing-library/user-event": "catalog:",
         "@types/jest": "catalog:",
-        "@types/luxon": "^3.7.4",
+        "@types/luxon": "^3.7.5",
         "@types/node": "catalog:",
         "@types/react": "catalog:",
         "@types/react-dom": "catalog:",
@@ -104,20 +118,6 @@
         "ultracite": "catalog:",
         "webpack": "^5.109.2"
     },
-    "repository": {
-        "type": "git",
-        "url": "git+https://github.com/aragon/app.git"
-    },
-    "bugs": {
-        "url": "https://github.com/aragon/app/issues"
-    },
-    "keywords": [
-        "aragon",
-        "dao",
-        "react",
-        "nextjs",
-        "tailwind"
-    ],
     "engines": {
         "node": ">=24.16.0"
     }

apps/app/src/modules/finance/components/assetAddressSelect/assetAddressSelectAddAddressView.test.tsx

@@ -155,7 +155,7 @@ describe('<AssetAddressSelectAddAddressView /> component', () => {
             screen.getByRole('searchbox'),
             '0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0',
         );
-        await user.click(screen.getByText('Wrapped stETH'));
+        await user.click(screen.getByRole('button', { name: /Wrapped stETH/ }));
 
         expect(onAssetClick).toHaveBeenCalledWith(
             expect.objectContaining({

apps/app/src/modules/finance/components/transactionList/transactionList.test.tsx

@@ -322,10 +322,10 @@ describe('<TransactionList.Default /> component', () => {
 
         render(createTestComponent({ onTransactionClick }));
 
-        await user.click(screen.getByText('0 ABC'));
+        await user.click(screen.getByRole('link', { name: /0 ABC/ }));
         expect(onTransactionClick).not.toHaveBeenCalled();
 
-        await user.click(screen.getByText('Executed'));
+        await user.click(screen.getByRole('link', { name: /Executed/ }));
         expect(onTransactionClick).toHaveBeenCalledWith(executionTransaction);
     });
 

apps/app/src/plugins/capitalDistributorPlugin/pages/capitalDistributorRewardsPage/capitalDistributorRewardsPage.tsx

@@ -28,8 +28,6 @@ const getConnectedAccount = (
     if (connections instanceof Map && current) {
         return connections.get(current)?.accounts[0];
     }
-
-    return;
 };
 
 const campaignsPerPage = 5;

apps/app/src/shared/featureFlags/featureFlags.api.ts

@@ -95,5 +95,5 @@ export interface IFeatureFlagsProvider {
      * perspective. Any per-request details (cookies, headers, etc.) must be
      * resolved inside this method.
      */
-    loadOverrides(): Promise<FeatureFlagOverrides>;
+    loadOverrides: () => Promise<FeatureFlagOverrides>;
 }

apps/app/src/shared/featureFlags/providers/githubProvider.ts

@@ -24,8 +24,6 @@ const getEnvironmentValue = (
 
         return typeof envValue === 'boolean' ? envValue : undefined;
     }
-
-    return;
 };
 
 const loadCmsOverrides = async (

apps/app/src/shared/security/htmlSanitizer.ts

@@ -48,9 +48,9 @@ export const isSafeUrl = (href: string): boolean => /^(https?:|\/)/i.test(href);
 // This applies for all sanitizations below
 interface AnchorNode {
     tagName?: string;
-    getAttribute(name: string): string | null;
-    setAttribute(name: string, value: string): void;
-    removeAttribute(name: string): void;
+    getAttribute: (name: string) => string | null;
+    setAttribute: (name: string, value: string) => void;
+    removeAttribute: (name: string) => void;
 }
 
 const isAnchorNode = (node: unknown): node is AnchorNode =>

apps/app/src/shared/testUtils/generators/formContext.ts

@@ -25,6 +25,7 @@ export const generateFormContext = (
 ): UseFormReturn => ({
     watch: jest.fn(),
     getValues: jest.fn(),
+    getErrors: jest.fn(),
     getFieldState: jest.fn(),
     setError: jest.fn(),
     clearErrors: jest.fn(),

apps/app/src/shared/testUtils/generators/reactQueryResponse.ts

@@ -15,7 +15,6 @@ const generateReactQueryResultBase = <TData, TError>(
     result?: Partial<QueryObserverBaseResult<TData, TError>>,
 ): QueryObserverBaseResult<TData, TError> => ({
     data: undefined,
-    promise: new Promise((resolve) => resolve({} as TData)),
     error: null,
     isError: false,
     isLoading: false,

apps/app/src/shared/utils/errorUtils/errorUtils.test.ts

@@ -61,9 +61,7 @@ describe('errorUtils', () => {
         it('ignores non-serializable properties', () => {
             const error = {
                 message: 'test',
-                fn: () => {
-                    return;
-                },
+                fn: jest.fn(),
                 symbol: Symbol('test'),
             };
 

apps/app/src/shared/utils/pendingTransactionManager/pendingTransactionManager.test.ts

@@ -394,6 +394,7 @@ describe('pendingTransactionManager', () => {
         });
 
         it('looks the receipt up on the chain the transaction was broadcast to', () => {
+            // biome-ignore lint/correctness/noUnusedInstantiation: the hydration side effect of the constructor is the behavior under test.
             new PendingTransactionManager();
 
             expect(getReceiptSpy).toHaveBeenCalledWith(expect.anything(), {

apps/app/src/shared/utils/translationsUtils/translationsUtils.ts

@@ -28,8 +28,6 @@ class TranslationsUtils {
                                 >
                             )[key];
                         }
-
-                        return;
                     },
                     translations,
                 );

apps/assistant/package.json

@@ -1,23 +1,27 @@
 {
     "name": "@aragon/assistant",
     "version": "0.2.0",
+    "private": true,
     "description": "Aragon assistant service: support-chat intake API",
-    "author": "Aragon Association",
     "homepage": "https://github.com/aragon/app#readme",
-    "private": true,
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/aragon/app.git"
+    },
     "license": "GPL-3.0",
+    "author": "Aragon Association",
     "type": "module",
     "scripts": {
-        "dev": "pnpm --filter @aragon/assistant-contracts build && pnpm run setup local && tsx watch --env-file-if-exists=.env --env-file=.env.local src/dev.ts",
         "build": "tsup",
+        "dev": "pnpm --filter @aragon/assistant-contracts build && pnpm run setup local && tsx watch --env-file-if-exists=.env --env-file=.env.local src/dev.ts",
+        "lint": "biome check --write --no-errors-on-unmatched --files-ignore-unknown=true",
+        "lint:check": "biome check --no-errors-on-unmatched --files-ignore-unknown=true",
+        "setup": "./scripts/setupEnv.sh",
         "test": "jest",
         "test:changed": "jest --ci --passWithNoTests --changedSince=\"$(git merge-base HEAD origin/main 2>/dev/null || echo main)\"",
-        "test:watch": "jest --watch",
         "test:coverage": "jest --coverage",
-        "lint": "biome check --write --no-errors-on-unmatched --files-ignore-unknown=true",
-        "lint:check": "biome check --no-errors-on-unmatched --files-ignore-unknown=true",
-        "type-check": "tsc --noEmit",
-        "setup": "./scripts/setupEnv.sh"
+        "test:watch": "jest --watch",
+        "type-check": "tsc --noEmit"
     },
     "dependencies": {
         "@aragon/assistant-contracts": "workspace:*",
@@ -45,10 +49,6 @@
         "tsx": "catalog:",
         "typescript": "catalog:"
     },
-    "repository": {
-        "type": "git",
-        "url": "git+https://github.com/aragon/app.git"
-    },
     "engines": {
         "node": ">=24.16.0"
     }

apps/assistant/src/chat/tools/createLinearTicket.ts

@@ -169,7 +169,9 @@ export const createSessionTicket = async (
         await sessionStore.releaseTicketSlot(sessionId);
         observability.logError(error, { sessionId, step: 'createTicket' });
 
-        throw new Error('Creating the ticket failed. Please try again.');
+        throw new Error('Creating the ticket failed. Please try again.', {
+            cause: error,
+        });
     }
 };
 

apps/assistant/src/files/blobStore.ts

@@ -14,11 +14,11 @@ export interface IBlobInfo {
 // reads them back for validation and the final transfer to Linear.
 export interface IBlobStore {
     // Downloads the blob bytes; throws when the blob does not exist or the fetch fails.
-    fetchBytes(url: string): Promise<Uint8Array>;
+    fetchBytes: (url: string) => Promise<Uint8Array>;
     // Best-effort bulk deletion (idempotent on the blob store side).
-    delete(urls: string[]): Promise<void>;
+    delete: (urls: string[]) => Promise<void>;
     // Lists ALL blobs under the prefix (follows pagination).
-    list(prefix: string): Promise<IBlobInfo[]>;
+    list: (prefix: string) => Promise<IBlobInfo[]>;
 }
 
 export const createVercelBlobStore = (): IBlobStore => {