chore(deps): bump the production-minor-patch group across 1 directory with 21 updates

.github/dependabot.yml

@@ -37,6 +37,12 @@ updates:
     ignore:
       # Catalog-managed; bump manually via pnpm-workspace.yaml + changeset.
       - dependency-name: "@cipherstash/auth"
+      # Release-managed manually alongside stack releases. Grouped bumps are
+      # actively harmful here: Dependabot's "group consistency" once upgraded
+      # the sunsetting packages/protect off its 0.23.0 pin (0.24+ renames the
+      # exports it imports) while DOWNGRADING the stack packages from 0.29.0
+      # (see #673).
+      - dependency-name: "@cipherstash/protect-ffi"
       # 0.x bumps ship breaking type changes (e.g. 0.2 → 0.3 tightened the
       # FailureOption constraint). Review and apply manually.
       - dependency-name: "@byteslice/result"

examples/basic/package.json

@@ -15,7 +15,7 @@
     "@cipherstash/stack-drizzle": "workspace:*",
     "@cipherstash/stack-supabase": "workspace:*",
     "dotenv": "^17.4.2",
-    "pg": "8.20.0"
+    "pg": "8.22.0"
   },
   "devDependencies": {
     "stash": "workspace:*",

packages/bench/package.json

@@ -14,7 +14,7 @@
     "@cipherstash/stack": "workspace:*",
     "@cipherstash/stack-drizzle": "workspace:*",
     "drizzle-orm": "0.45.2",
-    "pg": "^8.20.0"
+    "pg": "^8.22.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.1",

packages/cli/package.json

@@ -48,12 +48,12 @@
 	"dependencies": {
 		"@cipherstash/auth": "catalog:repo",
 		"@cipherstash/migrate": "workspace:*",
-		"@clack/prompts": "1.4.0",
+		"@clack/prompts": "1.7.0",
 		"dotenv": "17.4.2",
 		"jiti": "2.7.0",
-		"pg": "8.20.0",
+		"pg": "8.22.0",
 		"picocolors": "^1.1.1",
-		"posthog-node": "^5.34.2",
+		"posthog-node": "^5.40.0",
 		"zod": "^3.25.76"
 	},
 	"//optionalDependencies": "@cipherstash/auth ships per-platform native bindings as optional peerDependencies. pnpm does not auto-install platform-matched optional peer deps, so we declare them here as optionalDependencies — pnpm then picks the binary matching the host's os/cpu (from each sub-package's own package.json) and ignores the rest. All seven names share a single catalog entry to keep them in lockstep.",

packages/migrate/package.json

@@ -57,7 +57,7 @@
     "@cipherstash/stack": "workspace:*",
     "@types/pg": "^8.20.0",
     "dotenv": "^17.4.2",
-    "pg": "8.20.0",
+    "pg": "8.22.0",
     "tsup": "catalog:repo",
     "typescript": "catalog:repo",
     "vitest": "catalog:repo"

packages/nextjs/package.json

@@ -51,7 +51,7 @@
 		"access": "public"
 	},
 	"optionalDependencies": {
-		"@rollup/rollup-linux-x64-gnu": "4.60.4"
+		"@rollup/rollup-linux-x64-gnu": "4.62.2"
 	},
 	"dependencies": {
 		"jose": "^6.2.3"

packages/prisma-next/package.json

@@ -90,7 +90,7 @@
 		"@prisma-next/sql-runtime": "0.14.0",
 		"@prisma-next/ts-render": "0.14.0",
 		"@prisma-next/utils": "0.14.0",
-		"arktype": "^2.1.29"
+		"arktype": "^2.2.3"
 	},
 	"devDependencies": {
 		"@prisma-next/adapter-postgres": "0.14.0",

packages/protect/package.json

@@ -72,11 +72,11 @@
 		"@byteslice/result": "^0.2.0",
 		"@cipherstash/protect-ffi": "0.23.0",
 		"@cipherstash/schema": "workspace:*",
-		"@stricli/core": "^1.2.7",
+		"@stricli/core": "^1.2.9",
 		"dotenv": "17.4.2",
 		"zod": "^3.25.76"
 	},
 	"optionalDependencies": {
-		"@rollup/rollup-linux-x64-gnu": "4.60.4"
+		"@rollup/rollup-linux-x64-gnu": "4.62.2"
 	}
 }

packages/stack-supabase/package.json

@@ -77,7 +77,7 @@
 		"@types/pg": "^8.20.0",
 		"fast-check": "^4.9.0",
 		"dotenv": "17.4.2",
-		"pg": "8.20.0",
+		"pg": "8.22.0",
 		"postgres": "^3.4.8",
 		"tsup": "catalog:repo",
 		"typescript": "catalog:repo",

packages/stack/package.json

@@ -203,7 +203,7 @@
 	},
 	"devDependencies": {
 		"@cipherstash/eql": "3.0.0",
-		"@clack/prompts": "^1.4.0",
+		"@clack/prompts": "^1.7.0",
 		"@clerk/backend": "3.11.2",
 		"@supabase/postgrest-js": "2.110.1",
 		"@supabase/supabase-js": "^2.110.1",
@@ -215,7 +215,7 @@
 		"fast-check": "^4.9.0",
 		"fta-cli": "3.0.0",
 		"json-schema-to-typescript": "^15.0.2",
-		"pg": "8.20.0",
+		"pg": "8.22.0",
 		"postgres": "^3.4.8",
 		"tsup": "catalog:repo",
 		"tsx": "catalog:repo",
@@ -230,7 +230,7 @@
 		"@cipherstash/auth": "catalog:repo",
 		"@cipherstash/protect-ffi": "0.29.0",
 		"evlog": "1.11.0",
-		"uuid": "14.0.0",
+		"uuid": "14.0.1",
 		"zod": "3.25.76"
 	},
 	"//optionalDependencies": "@cipherstash/auth ships per-platform native bindings as optional peerDependencies. pnpm does not auto-install platform-matched optional peer deps, so we declare them here as optionalDependencies — pnpm then picks the binary matching the host's os/cpu (from each sub-package's own package.json) and ignores the rest. Required because @cipherstash/stack re-exports the Node auth strategies (OidcFederationStrategy, AccessKeyStrategy, …). All seven names share a single catalog entry to keep them in lockstep.",

packages/wizard/package.json

@@ -29,14 +29,14 @@
 		"lint": "biome check ."
 	},
 	"dependencies": {
-		"@anthropic-ai/claude-agent-sdk": "^0.3.143",
-		"@anthropic-ai/sdk": "^0.106.0",
+		"@anthropic-ai/claude-agent-sdk": "^0.3.204",
+		"@anthropic-ai/sdk": "^0.110.0",
 		"@cipherstash/auth": "catalog:repo",
-		"@clack/prompts": "1.4.0",
+		"@clack/prompts": "1.7.0",
 		"dotenv": "17.4.2",
-		"pg": "8.20.0",
+		"pg": "8.22.0",
 		"picocolors": "^1.1.1",
-		"posthog-node": "^5.34.2",
+		"posthog-node": "^5.40.0",
 		"zod": "^3.25.76"
 	},
 	"//optionalDependencies": "@cipherstash/auth ships per-platform native bindings as optional peerDependencies. pnpm does not auto-install platform-matched optional peer deps, so we declare them here as optionalDependencies — pnpm then picks the binary matching the host's os/cpu (from each sub-package's own package.json) and ignores the rest. All seven names share a single catalog entry to keep them in lockstep.",