chore(backend): update all backend dependencies to latest

[karutoil]

Summary

Bring all catalyst-backend dependencies (runtime + dev) up to their latest compatible versions, then verify the API still builds, migrates, lints, and passes tests.

This is a full refresh beyond Dependabot's weekly grouped minor/patch PRs — include major bumps where feasible, with intentional decisions documented for anything we intentionally pin or defer.

Scope

Item	Path
Package	catalyst-backend/package.json
Lockfile	root pnpm-lock.yaml (pnpm workspace)
Prisma	prisma / @prisma/client / @prisma/adapter-pg + schema/migrations
Overrides	existing overrides (e.g. @peculiar/asn1-schema) — re-evaluate necessity after upgrade

Key stacks to refresh

• Fastify + @fastify/* plugins (cors, helmet, multipart, rate-limit, swagger, websocket, compress)
• Prisma 7.x line and PostgreSQL adapter
• better-auth (+ passkey) / SimpleWebAuthn
• AWS SDK S3 client
• Zod (+ zod-to-json-schema)
• Pino, dotenv, node-cron, ssh2, pg/mysql2
• TypeScript, ESLint, Vitest, tsx

Acceptance criteria

• Audit current vs latest for every dependency in catalyst-backend/package.json (pnpm outdated --filter catalyst-backend or equivalent).
• Update all feasible packages to latest; document any intentionally skipped majors (reason + follow-up issue if needed).
• Revisit overrides — remove if no longer required, or update pins with justification.
• pnpm install succeeds; lockfile updated at repo root.
• pnpm --filter catalyst-backend run db:generate succeeds after Prisma bumps.
• pnpm --filter catalyst-backend run lint passes.
• pnpm --filter catalyst-backend run build passes (includes fix-esm-extensions.mjs post-tsc).
• pnpm --filter catalyst-backend run test passes.
• Auth, WebSocket, file upload, and DB paths smoke-tested if majors land (especially Fastify / Prisma / better-auth).
• Docker packaging still works (pnpm --filter catalyst-backend deploy --prod --legacy pattern; see issue Container catalyst-backend fails to start #206 lessons — hoisted workspace node_modules must not break runtime).
• PR notes call out breaking changes and required code/migrations.

Suggested approach

1. Run pnpm outdated --filter catalyst-backend and capture the baseline.
2. Update patch/minor first; then majors by stack (Fastify plugins → Prisma → auth → AWS SDK → tooling).
3. After Prisma bumps: regenerate client, run migrations against a disposable DB, fix adapter/config drift (prisma/prisma.config.ts).
4. Keep better-auth / zod / typescript aligned with frontend when versions are shared.
5. Validate production image packaging if dependency graph or Prisma engines change.
6. Open a single PR (or stacked PRs for large majors).

Notes

• Dependabot already scans the monorepo root weekly. This issue is the deliberate full-upgrade pass.
• Keep Node >=20 support unless coordinated repo-wide.
• Secrets/env: do not reintroduce hardcoded secrets; API_KEY_SECRET falls back to BETTER_AUTH_SECRET only.
• Watch peer dependency conflicts across the pnpm workspace.

Related

• Frontend companion: chore(frontend): update all frontend dependencies to latest #219
• Agent companion: chore(agent): update all Rust agent dependencies to latest #221

[pullfrog]

  ^{｜ Build this ➔ ｜ Make a plan ➔}