chore(deps): take #26556's dev-dependency bumps, minus focus-scope and playwright

Re-applies Dependabot's development-dependencies group (#26556) on current
main, with two packages held back and the repairs its red Test UI shards
asked for:

- @radix-ui/react-focus-scope stays on 1.1.16. pnpm-workspace.yaml patches
  that exact version (the focus-trap race fix that keeps a lookup popover
  searchable inside a Dialog); 1.3.1 would ship unpatched, and
  dialog-popover-focus-scope.test.tsx fails on it.
- playwright and @playwright/test stay on their ranges. service-print and
  dogfood pin playwright-core 1.63.0 exact to the container's chromium
  build, so the bump forked playwright-core into two copies.
- The lockfile is deduped. Peer-resolved copies of react-router-dom
  (plugin-detail, plugin-designer), mysql2 and pg stayed on the old
  versions; the second react-router copy is what nulled the router
  context in RecordDetailView.recordOpenWaves-13010.test.tsx.
  check:lockfile-integrity is clean against main.
- The scaffold ranges follow the workspace: @object-ui/cli's routed app
  declares react-router-dom ^7.18.4, @object-ui/create-plugin's plugin
  declares vite-plugin-dts ^5.1.2.
- dependabot.yml ignores focus-scope and the playwright trio, so the next
  group PR does not bring them back.

Claude-Session: https://claude.ai/code/session_01L9qibwmEPoSR8apWBvbyFj
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/26556-scaffold-dev-ranges.md

@@ -0,0 +1,11 @@
+---
+'@object-ui/cli': patch
+'@object-ui/create-plugin': patch
+---
+
+chore(scaffold): generated apps and plugins declare the dev ranges this repository now builds with
+
+Clause-②: no
+Metadata-protocol: none
+
+The workspace moved `react-router-dom` to `^7.18.4` and `vite-plugin-dts` to `^5.1.2`. A routed app scaffolded by `@object-ui/cli` now declares `react-router-dom` `^7.18.4`, and a plugin scaffolded by `@object-ui/create-plugin` now declares `vite-plugin-dts` `^5.1.2`, so a new project starts on the same versions the in-repo packages are tested on.

.github/dependabot.yml

@@ -10,6 +10,21 @@ updates:
     commit-message:
       prefix: "chore(deps)"
       include: "scope"
+    ignore:
+      # pnpm-workspace.yaml patches this package at one exact version (the
+      # focus-trap race fix that keeps a lookup popover searchable inside a
+      # Dialog). A bump leaves the new version unpatched, so move it by hand:
+      # re-key the patch to the new version and run
+      # ui/packages/components/src/__tests__/dialog-popover-focus-scope.test.tsx.
+      - dependency-name: "@radix-ui/react-focus-scope"
+      # playwright-core is pinned exact (service-print, dogfood) to the chromium
+      # build the container image ships, and playwright / @playwright/test carry
+      # their own playwright-core. Bumping only the two ranges forks
+      # playwright-core into two copies, which check:lockfile-integrity refuses.
+      # Move all three together, by hand, with the browser build.
+      - dependency-name: "playwright"
+      - dependency-name: "@playwright/test"
+      - dependency-name: "playwright-core"
     groups:
       # Group all patch and minor updates together
       development-dependencies:

apps/docs/package.json

@@ -30,7 +30,7 @@
     "@tailwindcss/postcss": "^4.3.3",
     "@types/mdx": "^2.0.14",
     "@types/negotiator": "^0.6.5",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.4",
     "negotiator": "^1.1.0",

examples/embed-objectql/package.json

@@ -15,7 +15,7 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   }

package.json

@@ -218,15 +218,15 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@changesets/cli": "^3.0.3",
-    "@types/node": "^26.6.3",
-    "@typescript-eslint/parser": "^8.70.1",
-    "eslint": "^10.11.0",
+    "@types/node": "^26.6.5",
+    "@typescript-eslint/parser": "^8.72.0",
+    "eslint": "^10.13.0",
     "github-slugger": "2.0.0",
     "semver": "^7.8.5",
-    "svelte": "^5.57.1",
+    "svelte": "^5.57.2",
     "tsup": "^8.5.1",
     "tsx": "^4.23.15",
-    "turbo": "^2.11.5",
+    "turbo": "^2.11.10",
     "typescript": "^6.0.3",
     "yaml": "^2.9.1"
   },

packages/apps/account/package.json

@@ -28,7 +28,7 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"

packages/apps/setup/package.json

@@ -28,7 +28,7 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"

packages/apps/studio/package.json

@@ -28,7 +28,7 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"

packages/cli/package.json

@@ -136,7 +136,7 @@
     "@objectstack/driver-turso": "workspace:*",
     "@objectstack/plugin-dev": "workspace:*",
     "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },

packages/cloud-connection/package.json

@@ -36,7 +36,7 @@
   "devDependencies": {
     "@objectstack/lint": "workspace:*",
     "@objectstack/plugin-security": "workspace:*",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },