chore(deps): refresh bun.lock (lock-file maintenance)

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "after 2am and before 3am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

🦋 Changeset detected

Latest commit: d4c0ace

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@checkstack/backend	Patch
@checkstack/frontend	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (2) — an upgrade path exists, so these fail the build:
  [HIGH] react-router 7.18.1 -> fixed in 8.3.0  (GHSA-qwww-vcr4-c8h2)
  [HIGH] brace-expansion 5.0.7 -> fixed in 5.0.8  (CVE-2026-14257)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (2) — an upgrade path exists, so these fail the build:
  [HIGH] react-router 7.18.1 -> fixed in 8.3.0  (GHSA-qwww-vcr4-c8h2)
  [HIGH] brace-expansion 5.0.7 -> fixed in 5.0.8  (CVE-2026-14257)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (1) — an upgrade path exists, so these fail the build:
  [HIGH] brace-expansion 5.0.7 -> fixed in 5.0.8  (CVE-2026-14257)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

❌ PR Checks Failed

⚠️ Escalation: Automated fixes have not resolved the issues after 3 attempts. Manual intervention is required.

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	❌ Failed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Security Audit Failures (dependency graph)

🔎 Security Audit (dependency graph, incl. devDependencies)

❌ Fixable vulnerabilities (1) — an upgrade path exists, so these fail the build:
  [HIGH] brace-expansion 5.0.7 -> fixed in 5.0.8  (CVE-2026-14257)

⚠️  Known unfixed vulnerabilities (0) — surfaced, not gated:
  (none)

How to fix: This gate scans the whole dependency graph (incl. devDependencies) and fails only on findings with an upgrade path (a fixed version exists); unfixed findings are warnings, not gated. Run bun run audit:security locally to reproduce. Bump the affected direct dependency, or for a transitive package add a documented entry to security/managed-overrides.json plus matching overrides/resolutions in package.json (then bun install). Re-run bun run audit:overrides:check to confirm the override is consistent.

@enyineer The above code quality issues were found in this PR. Automated fixes have not resolved them after 3 attempts. Manual intervention is required.