deps: bump out CVEs and deprecations

apps/api/package.json

@@ -12,7 +12,7 @@
   },
   "dependencies": {
     "@escape.tech/graphql-armor": "3.1.1",
-    "@graphql-tools/merge": "9.0.8",
+    "@graphql-tools/merge": "9.1.6",
     "@graphql-yoga/plugin-response-cache": "3.10.0",
     "@hono-rate-limiter/cloudflare": "0.2.1",
     "@hono/zod-openapi": "1.1.5",
@@ -21,12 +21,12 @@
     "@scalar/hono-api-reference": "0.5.158",
     "graphql": "16.9.0",
     "graphql-yoga": "5.8.0",
-    "hono": "4.6.8",
+    "hono": "4.10.7",
     "hono-rate-limiter": "0.4.0",
     "zod": "4.1.13"
   },
   "devDependencies": {
     "@packages/key-types": "workspace:*",
-    "wrangler": "3.100.0"
+    "wrangler": "3.99.0"
   }
 }

apps/api/src/index.ts

@@ -15,6 +15,7 @@ import { DurableObjectRateLimiter } from "@hono-rate-limiter/cloudflare";
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { apiReference } from "@scalar/hono-api-reference";
 import { cors } from "hono/cors";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
 
 const app = new OpenAPIHono<{ Bindings: Env }>({ defaultHook });
 
@@ -36,7 +37,7 @@ app.use("/reference", referenceOgTagInjector(ogTitle)).get(
 app.onError((err, c) =>
   c.json<ErrorSchema>(
     { ok: false, message: err.message.replaceAll(/"/g, "'") },
-    { status: "getResponse" in err ? err.getResponse().status : 500 },
+    "getResponse" in err ? (err.getResponse().status as ContentfulStatusCode) : 500,
   ),
 );
 app.notFound((c) =>

apps/data-pipeline/larc-scraper/package.json

@@ -17,6 +17,6 @@
     "cross-fetch": "4.0.0"
   },
   "devDependencies": {
-    "wrangler": "3.100.0"
+    "wrangler": "3.99.0"
   }
 }

apps/data-pipeline/library-traffic-scraper/package.json

@@ -17,6 +17,6 @@
     "zod": "4.1.13"
   },
   "devDependencies": {
-    "wrangler": "3.100.0"
+    "wrangler": "3.99.0"
   }
 }

apps/data-pipeline/mview-refresher/package.json

@@ -13,6 +13,6 @@
     "@packages/db": "workspace:*"
   },
   "devDependencies": {
-    "wrangler": "3.100.0"
+    "wrangler": "3.99.0"
   }
 }

apps/data-pipeline/study-location-scraper/package.json

@@ -18,6 +18,6 @@
   },
   "devDependencies": {
     "domhandler": "5.0.3",
-    "wrangler": "3.100.0"
+    "wrangler": "3.99.0"
   }
 }

apps/data-pipeline/websoc-scraper/package.json

@@ -18,6 +18,6 @@
     "cross-fetch": "4.0.0"
   },
   "devDependencies": {
-    "wrangler": "3.100.0"
+    "wrangler": "3.99.0"
   }
 }

apps/key-manager/package.json

@@ -27,10 +27,10 @@
     "clsx": "2.1.1",
     "drizzle-orm": "0.36.0",
     "lucide-react": "0.460.0",
-    "next": "15.0.3",
+    "next": "16.0.10",
     "next-auth": "5.0.0-beta.25",
-    "react": "18.3.1",
-    "react-dom": "18.3.1",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
     "react-hook-form": "7.67.0",
     "sst": "3.3.22",
     "tailwind-merge": "2.5.4",
@@ -39,12 +39,12 @@
   },
   "devDependencies": {
     "@packages/key-types": "workspace:*",
-    "@types/react": "18.3.12",
-    "@types/react-dom": "18.3.1",
+    "@types/react": "19.2.7",
+    "@types/react-dom": "19.2.3",
     "drizzle-kit": "0.27.0",
     "postcss": "8.4.49",
     "tailwindcss": "3.4.15",
     "typescript": "5.6.3",
-    "wrangler": "3.100.0"
+    "wrangler": "3.99.0"
   }
 }

apps/key-manager/src/components/key/view/KeyTableRow.tsx

@@ -31,7 +31,7 @@ const KeyTableRow: React.FC<Props> = ({ apiKey, apiKeyData, apiKeys, setApiKeys
   const keyTypeToIcon = (keyType: string) => {
     const className = "size-4";
 
-    let icon: React.ReactElement | null;
+    let icon: React.JSX.Element | null;
 
     switch (keyType) {
       case "publishable":