chore(deps): update pinned dependencies

Bumps the exact-pinned deps, which caret ranges never pick up:
turbo, @playwright/test, @sentry/vite-plugin, vite-plugin-compression2,
react-icons, @base-ui/react, electron-builder, and the ts-essentials /
rimraf catalog entries. Plus dotenv ^16 -> ^17 (one consumer, `import
'dotenv/config'`) and wait-on ^7 -> ^9 (devDep, one CLI call).

No CI change needed for playwright: the workflow already derives its
browser cache key from `pnpm ls @playwright/test`.

Deliberately does NOT run a blanket `pnpm update -r`. Refreshing caret
drift pulls @types/express-serve-static-core 5.0.6 -> 5.1.3, which widens
`req.params` values to `string | string[]` and fails typecheck in 39
places across 8 routers. The widening is correct — express 5 can produce
array params — but adopting it is a source change of its own, and pnpm 11
cannot pin around it (overrides in package.json are silently ignored, and
the pnpm-workspace.yaml equivalent does not re-resolve).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NWs1vf42msmoJ21ABvQMpm

apps/client/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@base-ui/react": "1.6.0",
+    "@base-ui/react": "1.7.0",
     "@codemirror/commands": "^6.0.0",
     "@codemirror/lang-css": "^6.0.0",
     "@codemirror/state": "^6.0.0",
@@ -29,7 +29,7 @@
     "react-dom": "^19.2.7",
     "react-fast-compare": "^3.2.2",
     "react-hook-form": "^7.80.0",
-    "react-icons": "5.6.0",
+    "react-icons": "5.7.0",
     "react-router": "^8.0.1",
     "react-virtuoso": "^4.18.7",
     "zustand": "^5.0.14"
@@ -60,7 +60,7 @@
     ]
   },
   "devDependencies": {
-    "@sentry/vite-plugin": "5.1.1",
+    "@sentry/vite-plugin": "5.4.0",
     "@types/node": "catalog:",
     "@types/qrcode": "^1.5.6",
     "@types/react": "^19.1.12",
@@ -74,7 +74,7 @@
     "sass": "^1.57.1",
     "typescript": "catalog:",
     "vite": "8.2.1",
-    "vite-plugin-compression2": "2.5.1",
+    "vite-plugin-compression2": "2.5.3",
     "vite-plugin-svgr": "4.5.0",
     "vitest": "catalog:"
   }

apps/electron/package.json

@@ -14,8 +14,8 @@
   "main": "src/main.js",
   "devDependencies": {
     "electron": "38.2.1",
-    "electron-builder": "26.9.1",
-    "wait-on": "^7.2.0"
+    "electron-builder": "26.15.3",
+    "wait-on": "^9.0.0"
   },
   "scripts": {
     "dev:electron": "wait-on http://localhost:3000 && cross-env NODE_ENV=development electron .",

apps/server/package.json

@@ -10,7 +10,7 @@
     "cookie": "1.0.2",
     "cookie-parser": "1.4.7",
     "cors": "2.8.6",
-    "dotenv": "^16.0.1",
+    "dotenv": "^17.0.0",
     "express": "5.2.1",
     "express-static-gzip": "3.0.1",
     "express-validator": "7.3.2",

package.json

@@ -41,14 +41,14 @@
     "format:check": "oxfmt --check"
   },
   "devDependencies": {
-    "@playwright/test": "1.60.0",
+    "@playwright/test": "1.62.1",
     "@types/node": "catalog:",
     "cross-env": "^7.0.3",
     "oxfmt": "^0.42.0",
     "oxlint": "^1.78.0",
     "oxlint-tsgolint": "^7.0.2001",
     "rimraf": "catalog:",
-    "turbo": "2.8.20",
+    "turbo": "2.10.10",
     "typescript": "catalog:"
   },
   "packageManager": "pnpm@11.1.2+sha512.415a1cc25974731e75455c1468371be74c5aa5fb7621b50d4056d222451609f11412f23fd602e6169f1e060466641f798597e1be961a10688836a67b16569499",

pnpm-workspace.yaml

@@ -4,8 +4,8 @@ packages:
 
 catalog:
   '@types/node': 22.19.11
-  rimraf: 6.0.1
-  ts-essentials: 10.1.1
+  rimraf: 6.1.3
+  ts-essentials: 10.2.1
   typescript: 7.0.2
   vitest: 4.1.10