[ThePrismSystem]

Summary

Applies the open items on the Renovate dependency dashboard (#44) in one PR and adds the 0.4.0 changelog entry, so the release can be tagged from the merge commit. Each package moves to its newest release that is at least 7 days old, matching minimumReleaseAge in renovate.json, so a few stop short of latest (eslint lands on 10.13.0, for example, while 10.14.0 is six days old).

Two changes go beyond version bumps, because the bumps broke the image without them.

pnpm is now installed into the image at build time. pnpm 12 ships as a native binary. Corepack used to download pnpm into the /home/node/.cache tmpfs on the container's first start, and Docker mounts tmpfs noexec, so the container died with EACCES before the server started. The runtime stage now sets COREPACK_HOME=/usr/local/share/corepack and runs corepack install && pnpm --version during the build; that first pnpm run is what downloads the native binary. The container boots read-only with no network access and writes nothing to /home/node/.cache, so docker-compose.yml, the README and docs/SECURITY.md drop that tmpfs. A compose file that still mounts it keeps working.

The Go builder moves to 1.27.3, one patch past the dashboard's 1.27.2. Trivy reports HIGH CVE-2026-111943 (crypto/x509) against 1.27.2, and it is fixed in 1.27.3 and in the 1.26.10 that main already uses. 1.27.3 was released on 2026-10-19, so it also clears the 7-day window.

Changes

• Moves the Node floor to 26 in .nvmrc, engines.node, both Dockerfile stages, the README and CONTRIBUTING, which the node rule in renovate.json keeps in step. Node 25 stopped bundling corepack, so both Node stages run npm install -g corepack@${COREPACK_VERSION}. That pin is one global ARG, and a new regex manager in renovate.json keeps it current
• Updates pnpm to 12.16.1 through packageManager. The lockfile stays at v9.0
• Updates the runtime dependencies to React 19.3.1, TanStack Router 1.170.46, TanStack Query 5.105.0, hono 4.13.14, zod 4.6.7, tsx 4.23.15, marked 18.1.2 and chokidar 6.0.0. The watcher only calls watch, add, unwatch and close, and chokidar 6 changes none of them in a way that matters here
• Updates the dev majors: Vitest and @vitest/coverage-v8 5.0.5, @types/node 26 and eslint-plugin-unicorn 79
• Updates the non-major dev group: commitlint, eslint-comments, cspell, eslint, react-refresh, knip, lint-staged, prettier, typescript-eslint, axe-core, Playwright, Testing Library, @types/react, plugin-react and vite
• Updates the actions, each pinned to its commit SHA: setup-node v7.1.0, upload-artifact v7.0.2, codecov-action v7.1.1, codeql-action v4.39.1 and pnpm/action-setup v6.1.0
• Stops exporting RelationOrigin, which knip 6.43 reports as unused because only its own file refers to it. knip now finds e2e/fixtures/serve.mjs through Playwright's webServer, so its explicit entry is removed
• Adds the 0.4.0 CHANGELOG entry. It is a minor bump because raising the Node floor breaks source installs

Not included

• TypeScript 7. typescript-eslint 8.72.1 still declares typescript <6.1.0 and throws on import under 7.0.2, although tsc 7 typechecks the repo cleanly. chore(deps): apply pending renovate updates #46 chose to wait for typescript-eslint support instead of running the two versions side by side, and that support has not shipped (typescript-eslint#10940)
• graphql 17.1.0, jsdom 31.0.0 and zizmor 1.32.0. The dashboard lists them under "Pending Status Checks" because they are inside the 7-day window (published 1, 0 and 3 days ago). Renovate will open them once they age out
• pnpm 11.28.9, which pnpm 12 supersedes

Test Plan

• Full gate on Node 26.13: format, lint, typecheck, test:coverage, knip, spell, codegen:check, check:pins
• pnpm audit --audit-level moderate passes (the same 2 ignored as before)
• 715 unit and integration tests pass against a beans binary built by scripts/build-beans.sh, with coverage above 94% on every metric
• E2E 60/60
• docker build, then trivy image --severity HIGH,CRITICAL --ignore-unfixed with .trivyignore: no findings
• With the compose hardening (--read-only, --tmpfs /tmp, --cap-drop ALL, no-new-privileges), the container serves / and /api/projects for a seeded project with the old cache tmpfs, without it, as uid 1234, and under --network none
• Before the build-time install, the Node 26 and pnpm 12 image failed to boot with EACCES on pnpm-native

The one peer warning (@codecov/vite-plugin wants vite 6 or older) and the MaxListenersExceededWarning in the server's events.test.ts both predate this change.

Review Checklist

• Tests pass locally
• No breaking changes (or documented in summary)
• Documentation updated if needed
• Error handling considered
• Security implications reviewed

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[codecov]

Bundle Report

Changes will increase total bundle size by 33.01kB (1.99%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
beans-web-web-esm	865.3kB	33.01kB (3.97%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: beans-web-web-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
assets/index-*.js	27.64kB	369.25kB	8.09% ⚠️
assets/beanDetail-*.js	5.37kB	91.54kB	6.23% ⚠️

Files in assets/beanDetail-*.js:

• ./src/components/RelationEditor.tsx → Total Size: 7.05kB