[trevor-scheer]

Dependabot reports 183 open alerts on main. This refreshes dependencies across the workspace within their existing ranges, with targeted patch/minor updates where pins prevent security fixes. pnpm audit --json goes from 183 findings (6 critical, 80 high) to 34 (0 critical, 10 high). Dependabot's alert count may differ when it reevaluates the merged lockfile.

The bulk of the diff comes from pnpm update -r --no-save, followed by pnpm dedupe, using the repo's pnpm@10.34.5 and 72-hour release-age policy. This includes Storybook/Vitest security patches, current GraphQL Tools loaders, Zod 4, and scoped same-major overrides for DOMPurify 3 and PostCSS 8. Updating wait-on from 7.0.1 to 7.2.0 lets its upstream Axios 1 migration remove the old Axios advisories. Its readiness, server cleanup, and timeout behavior were exercised against a temporary local HTTP server.

The remaining findings need follow-up:

Dependency chain	Why it's deferred
@whatwg-node/fetch@0.2.8 → undici@5 → @fastify/busboy@2	Fixes require Undici 6+ and Busboy 3. Fetch's available 0.2 patch still uses Undici 5; upgrading its fetch implementation needs compatibility work.
@codemirror/buildhelper@0.1.16 → Mocha 10 → serialize-javascript@6	Fixed serialization requires 7+. The current buildhelper line retains Mocha 10, so this needs a buildhelper migration.
@changesets/cli@2.27.7 → cross-spawn@5 / tmp@0.0.33	Updating Changesets requires rebasing the repo's deliberate assemble-release-plan behavior patch. Its patched version is now explicitly pinned so refreshing the graph doesn't silently discard that patch.
Azure tooling → uuid@8	The fix requires UUID 11+. Azure Identity is held at compatible 4.13.0 to avoid introducing the MSAL authorization advisory; fixed Identity 4.14.1 is still inside the 72-hour window at the time of this update.
wgutils@1 → zod@3	The latest 1.x release still requires Zod 3; the fix requires Zod 4. The collections plugin's separate Zod 4 dependency is updated.
minimatch / glob	The latest fixes require major upgrades to 11.0.1 / 14.0.2, including direct published dependencies and older transitive copies.
Workbox → deepmerge@4.3.1	No patched release is available.

I also held Babel parser 8.0.4, Oxlint 1.63.0, and axe-core 4.13.0 at the existing versions: newer releases remove the server's importMeta parser option or introduce lint/accessibility findings that need separate code review. tsup uses compatible esbuild 0.27.2 to avoid introducing the Windows development-server advisory. Node types stay on the repo's declared 24.x line to prevent duplicate Vitest browser-provider types. The one test assertion change preserves its substring check with Vitest's updated matcher types.

The extension bundlers also exclude the new loader's optional content-tag compiler, alongside the existing optional template compilers.

Framer Motion also stays at 14.0.0: 14.7.1 adds tabIndex=0 to draggable tab containers, introducing an extra keyboard-navigation stop before the tab button.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4cb34e4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@graphiql/plugin-collections	Patch
@graphiql/react	Patch
graphql-language-service-server	Patch
vscode-graphql-execution	Patch
vscode-graphql	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR