build(deps): patch security overrides and refresh compatible tooling

.github/workflows/codeql.yml

@@ -28,12 +28,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           languages: javascript-typescript
           build-mode: none
 
       - name: Analyze
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           category: "/language:javascript-typescript"

CHANGELOG.md

@@ -4,7 +4,9 @@ All notable changes to Krillswitch are documented in this file.
 
 ## [Unreleased]
 
-- Pin local Worker tooling to workerd 1.20261021.1 to reject compromised eMudhra keys.
+- Raise the Undici and Zod security overrides to patched versions, unblocking Dependabot security updates for Worker tooling.
+- Refresh Carapace, Biome, Vite, Cloudflare types, and CodeQL while preserving the two-day dependency cooldown and Node.js runtime floor. Thanks @dependabot.
+- Pin local Worker tooling to workerd 1.20261021.1 to reject compromised eMudhra keys. Thanks @joshavant.
 
 ## [v0.6.0] - 2026-10-23
 

apps/admin/package.json

@@ -11,7 +11,7 @@
   "dependencies": {
     "@fontsource/ibm-plex-mono": "^5.3.0",
     "@fontsource/manrope": "^5.3.0",
-    "@openclaw/carapace": "github:openclaw/carapace#v0.6.2",
+    "@openclaw/carapace": "github:openclaw/carapace#v0.6.3",
     "@radix-ui/react-alert-dialog": "^1.2.1",
     "@radix-ui/react-select": "^2.4.1",
     "@tanstack/react-query": "^5.104.5",
@@ -28,6 +28,6 @@
     "@vitejs/plugin-react": "^6.1.2",
     "tailwindcss": "^4.3.3",
     "typescript": "~7.0.2",
-    "vite": "^8.3.4"
+    "vite": "^8.3.5"
   }
 }

apps/api/package.json

@@ -26,11 +26,11 @@
     "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@cloudflare/vitest-plugin": "^1.4.5",
-    "@cloudflare/workers-types": "^5.20261019.1",
+    "@cloudflare/vitest-plugin": "^1.4.7",
+    "@cloudflare/workers-types": "^5.20261022.1",
     "drizzle-kit": "^0.31.11",
     "typescript": "~7.0.2",
     "vitest": "^5.0.5",
-    "wrangler": "^4.151.2"
+    "wrangler": "^4.152.0"
   }
 }

apps/demo/package.json

@@ -18,6 +18,6 @@
     "@types/react-dom": "^19.3.0",
     "@vitejs/plugin-react": "^6.1.2",
     "typescript": "~7.0.2",
-    "vite": "^8.3.4"
+    "vite": "^8.3.5"
   }
 }

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.6.2/schema.json",
   "files": {
     "includes": [
       "**",
@@ -10,6 +10,8 @@
       "!**/admin/src/index.css"
     ]
   },
+  "markdown": { "formatter": { "enabled": false } },
+  "yaml": { "formatter": { "enabled": false } },
   "formatter": {
     "enabled": true,
     "indentStyle": "space"

package.json

@@ -24,7 +24,7 @@
     "deploy:production": "pnpm run deploy:admin"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.15",
+    "@biomejs/biome": "2.6.2",
     "autocannon": "8.0.0"
   },
   "engines": {

packages/react/src/krillswitch.test.tsx

@@ -595,6 +595,7 @@ describe("freshness", () => {
     let move: (() => void) | undefined;
     let bump: (() => void) | undefined;
 
+    // biome-ignore lint/correctness/noComponentHookFactories: This fixture is created once per test, outside React rendering.
     function SuspendedProbe({ contextKey }: { contextKey: string }) {
       const souls = useFeatureFlag("souls");
       if (contextKey === "user-b") {
@@ -603,6 +604,7 @@ describe("freshness", () => {
       return <output data-testid="concurrent-souls">{String(souls)}</output>;
     }
 
+    // biome-ignore lint/correctness/noComponentHookFactories: This fixture is created once per test, outside React rendering.
     function ConcurrentDemo() {
       const [contextKey, setContextKey] = useState("user-a");
       const [, setTick] = useState(0);

packages/react/src/krillswitch.tsx

@@ -151,6 +151,7 @@ function createClient<M extends FlagManifest>(
   const FlagContext = createContext<M>(manifest);
   const evaluateFlags = createFlagEvaluator(manifest);
 
+  // biome-ignore lint/correctness/noComponentHookFactories: The public SDK factory creates these once at module scope.
   function FeatureFlagProvider(props: FeatureFlagProviderProps<M>): ReactNode {
     const {
       evalKey,
@@ -305,10 +306,12 @@ function createClient<M extends FlagManifest>(
     );
   }
 
+  // biome-ignore lint/correctness/noComponentHookFactories: The public SDK factory creates these once at module scope.
   function useFeatureFlags(): M {
     return useContext(FlagContext);
   }
 
+  // biome-ignore lint/correctness/noComponentHookFactories: The public SDK factory creates these once at module scope.
   function useFeatureFlag<K extends Extract<keyof M, string>>(key: K): M[K] {
     return useFeatureFlags()[key];
   }