[NoelHuibers]

This updates the application's direct dependencies and package manager, adds weekly Dependabot updates for pnpm and GitHub Actions, and introduces CI typecheck, production-build and desktop/mobile public-page browser checks. The browser suite now checks the existing landing-page contract rather than expecting an obsolete redirect.

The update includes Next 16.4.2, React 19.3.1, AI SDK 7, iron-session 9, Motion 14, TypeScript 7, Vitest 5 and pnpm 12. Node remains on the supported 24 LTS line; Node types match that runtime. The complete package inventory and compatibility notes are in docs/dependency-upgrade.md.

Validation completed locally:

• Frozen install, Biome, TypeScript and production build pass.
• 238 unit/component tests pass, including real AI adapter HTTP contracts, actual Next proxy cookie transport with an iron-session 8 fixture, and Tiptap editing.
• Six production browser checks pass across desktop and mobile, including theme hydration and tour replay/dismissal.
• Drizzle config/schema generation passes for 12 tables in temporary output, without connecting to a database.
• Actions syntax and Dependabot schema validation pass.

The package audit drops from 81 findings to two remaining transitive advisories: high image-size and moderate sprintf-js below deck.gl loader tooling. No incompatible major transitive override is forced. Full database/provider/Inngest/WebGL workflows remain outside the verified public smoke scope. Existing first-party product findings require separate fixes and are not resolved by this maintenance PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
inklings	Ready	Preview	Oct 20, 2026 11:22pm UTC