chore(deps): roll up 8 dependency update(s)

[mathieusouflis]

Dependency Rollup

Every update here satisfies its existing constraint — the package itself promises compatibility.

Package	From	To
@biomejs/biome	^2.5.3	^2.5.4
@clerk/nextjs	^7.5.17	^7.5.18
@tanstack/react-router	^1.170.17	^1.170.18
@tanstack/router-plugin	^1.168.19	^1.168.20
@types/supertest	^7.2.0	^7.2.1
jotai	^2.20.1	^2.20.2
posthog-js	^1.399.2	^1.402.0
tsx	^4.23.0	^4.23.1

⚠️ This branch is rebuilt from scratch on every run — do not push to it.
If one of these breaks the templates, eject it into its own PR:
the next Rollup will then exclude it automatically.

Generator manifests are not bumped here. They are derived at release from
Fingerprints, so merge order cannot corrupt them (ADR-0002).

---

🤖 dep-checker

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

Updates the repo’s machine-owned npm dependency pin map (internal/deps/npm.go) as part of an automated dependency rollup produced by dep-checker.

Changes:

• Bumps multiple npm package version ranges in the central deps pin map (including Biome, Clerk, TanStack Router, Jotai, PostHog, and others).
• Refreshes several additional frontend/tooling pins beyond the 8 packages listed in the PR description (e.g., Sentry, Storybook, Tailwind, React/Next, Vite, etc.).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

internal/deps/npm.go:18

• The PR description says this rollup updates 8 packages and lists specific From/To versions (e.g. @biomejs/biome ^2.5.3 → ^2.5.4 and @clerk/nextjs ^7.5.17 → ^7.5.18), but this diff bumps many more packages and the To versions shown here don’t match the table (e.g. @biomejs/biome is ^2.5.6, @clerk/nextjs is ^7.6.2). Please either (1) update the PR title/body table to accurately reflect all bumps and their versions, or (2) revert the extra version bumps so the code matches the stated scope.

	"@biomejs/biome":                 "^2.5.6",
	"@clerk/clerk-react":             "^5.61.3",
	"@clerk/nextjs":                  "^7.6.2",
	"@pandacss/dev":                  "^1.12.0",
	"@playwright/test":               "^1.62.0",

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

internal/deps/npm.go:16

• The PR metadata says this rollup updates 8 dependencies (and lists specific From/To versions), but this file bumps many more packages (e.g., @pandacss/dev, @playwright/test, @sentry/, storybook, tailwindcss*, react*, next, vite, etc.) and several of the listed packages don’t match the stated target versions (e.g., @biomejs/biome -> ^2.5.7 vs ^2.5.4; @clerk/nextjs -> ^7.6.5 vs ^7.5.18; tsx -> ^4.23.7 vs ^4.23.1). This mismatch makes it hard to review and can break the “eject into its own PR” workflow; please either (a) narrow this change to the 8 listed updates, or (b) update the PR description/title to accurately reflect the full set of bumps (or split into multiple PRs).

	"@ark-ui/react":                  "^5.38.0",
	"@asteasolutions/zod-to-openapi": "^8.5.0",
	"@biomejs/biome":                 "^2.5.7",
	"@clerk/clerk-react":             "^5.61.3",
	"@clerk/nextjs":                  "^7.6.5",

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud