chore(deps): batch dependabot updates (9 safe + 1 type-compat fix)

[tomber]

Summary

Bundles 9 safe dependabot PRs into one merge so we trim the open-PR queue and avoid 9 separate CI roundtrips. Also folds in PR #169 (a 4-line type-compat fix that's needed when ext-apps@1.7+ is bumped — without it the example builds fail typecheck).

What's bundled

CI workflow bumps

• pnpm/action-setup 4 → 6 (closes ci(deps): bump pnpm/action-setup from 4 to 6 #165)
• actions/create-github-app-token 2 → 3 (closes ci(deps): bump actions/create-github-app-token from 2 to 3 #164)

Runtime/dev dep bumps

• @supabase/supabase-js 2.102.1 → 2.105.1 (closes chore(deps): bump @supabase/supabase-js from 2.102.1 to 2.105.1 #112)
• next 16.2.2 → 16.2.4 (closes chore(deps): bump next from 16.2.2 to 16.2.4 #111)
• inquirer 13.4.0 → 13.4.2 (closes chore(deps): bump inquirer from 13.4.0 to 13.4.2 #110)
• @modelcontextprotocol/ext-apps 1.5.0 → 1.7.1 (closes chore(deps): bump @modelcontextprotocol/ext-apps from 1.5.0 to 1.7.1 #108)
• react 19.2.4 → 19.2.5 (closes chore(deps): bump react from 19.2.4 to 19.2.5 #94)
• dotenv 17.4.1 → 17.4.2 (closes chore(deps): bump dotenv from 17.4.1 to 17.4.2 #92)
• react-dom 19.2.4 → 19.2.5 (closes chore(deps): bump react-dom from 19.2.4 to 19.2.5 #91)

Type-compat fix bundled in

• packages/react/src/mcp/McpApp.tsx: relax addEventListener/removeEventListener event arg from string to any. ext-apps@1.7+ tightened the event type to K extends keyof AppEventMap, breaking the loose shape McpAppFull declared. 4-line fix, cherry-picked from PR fix(react): relax event listener type to maintain compatibility with ext-apps #169 (which was opened against this exact incompatibility but never merged). Closes fix(react): relax event listener type to maintain compatibility with ext-apps #169.

Skipped (need separate handling)

• chore(deps-dev): bump the dev-dependencies group across 1 directory with 22 updates #163 dev-dependencies group (22 updates) — has FAILURE in CI on its own branch, needs investigation
• chore(deps): bump lucide-react from 0.469.0 to 1.14.0 #109 lucide-react 0.469 → 1.14 — major version with potential icon renames
• chore(deps-dev): bump stripe from 21.0.1 to 22.1.1 #88 stripe 21 → 22 — devDep major bump, type changes possible

Methodology + caveat

Sequential git merge -X theirs for the 9 dependabot branches, then pnpm install to reconcile the lockfile. The -X theirs strategy auto-resolves conflicts in the incoming branch's favour, but for files touched by multiple bumps (e.g. examples/checkout-demo/package.json is touched by 4 PRs) the LATEST merge's whole file wins — silently reverting earlier bumps in the same file. I caught this when the build broke on tailwind-checkout typechecking against two next versions, audited every multi-bump file (8 affected), and patched the missed bumps in commit 616bbea (`react ^19.2.4 → ^19.2.5` in 7 files, `next ^16.2.1 → ^16.2.4` in 3 files). Also bumped examples/shared next via `pnpm update` to dedupe the 16.2.2/16.2.4 split.

Test plan

• `pnpm test` (full turbo) — 24/24 successful
• `pnpm lint` — 13/13 successful (FULL TURBO cache)
• `pnpm build --filter '!hosted-checkout-demo' --filter '!checkout-demo'` — 29/29 successful
• Verified `hosted-checkout-demo` and `checkout-demo` builds fail with the SAME `supabaseUrl is required` error on `origin/dev` (pre-existing missing env var during static prerender, not a regression from this batch)
• Confirm CI on this PR mirrors the local result (24 test + 13 lint + the same 2 Next examples failing build)

Made with Cursor

---

Note

Low Risk
Low risk dependency and GitHub Actions version bumps; the only code change relaxes McpApp event listener typing to restore compatibility with @modelcontextprotocol/ext-apps@1.7+.

Overview
Dependency/CI maintenance batch. Updates GitHub Actions used in workflows (pnpm/action-setup@v6, actions/create-github-app-token@v3) and bumps multiple JS deps across packages/examples (notably next, react/react-dom, @supabase/supabase-js, dotenv, inquirer, and @modelcontextprotocol/ext-apps), with corresponding pnpm-lock.yaml refresh.

Type compatibility fix. Adjusts packages/react McpAppFull to accept non-string event keys by loosening addEventListener/removeEventListener evt typing, keeping builds type-safe after the ext-apps upgrade.

^{Reviewed by Cursor Bugbot for commit 616bbea. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 616bbea. Configure here.}

[cursor]

Deprecated app-id input used with create-github-app-token@v3

Low Severity

The bump from actions/create-github-app-token@v2 to @v3 means the workflow now resolves to v3.1.0+, which deprecated the app-id input in favor of client-id. While app-id still works as a fallback today, it may be removed in a future v3.x release, potentially breaking the publish workflow without warning.

 

^{Reviewed by Cursor Bugbot for commit 616bbea. Configure here.}