chore: update dependencies (TypeScript 6.0, mysql2, hono, and others)

[repowarden-app]

Summary

This PR updates 7 dependencies including a major TypeScript upgrade to 6.0.2, along with minor and patch updates for database clients, testing tools, and type definitions.

Updates

Major

• typescript: 5.9.3 → 6.0.2 ⚠️

Minor

• mysql2: 3.20.0 → 3.22.0
• @types/node: 25.5.0 → 25.6.0
• hono: 4.12.9 → 4.12.12

Patch

• knex: 3.2.7 → 3.2.9
• @biomejs/biome: 2.4.9 → 2.4.11
• ts-jest: 29.4.6 → 29.4.9

Risk Assessment

Risk Level: HIGH 🔴

The TypeScript 6.0 major version update introduces breaking changes that may affect type checking and compilation. The tsconfig.json may need updates to accommodate new compiler options or deprecated settings. Other updates are low risk.

Action Items

• Review and update tsconfig.json for TypeScript 6.0 compatibility
• Check for TypeScript breaking changes in codebase
• Verify ts-jest configuration works with TypeScript 6.0
• Review mysql2 changelog for any API changes (3.20 → 3.22)

Testing Recommendations

Since this is a library, comprehensive testing is critical:

• Run full test suite: pnpm test
• Verify TypeScript compilation: pnpm tsc --noEmit
• Test against all target Node.js LTS versions: 18, 20, 22
• Verify database connections (knex + mysql2 updates)
• Check that all type definitions resolve correctly
• Review peer dependency ranges in package.json - may need updating for TypeScript 6.0
• Build and test example integrations if available
• Lint codebase: pnpm biome check

Related PRs

The following Dependabot PRs can be closed after merging this update:

• Bump @types/node from 25.5.0 to 25.5.2 #96: Bump @types/node from 25.5.0 to 25.5.2 (superseded by 25.6.0)
• Bump hono from 4.12.9 to 4.12.11 #95: Bump hono from 4.12.9 to 4.12.11 (superseded by 4.12.12)
• Bump knex from 3.2.7 to 3.2.9 #94: Bump knex from 3.2.7 to 3.2.9 ✓

---

🤖 Generated by RepoWarden

Available Commands

Comment on this PR with any of the following:

• @repowarden rebase — Rebase this PR onto the base branch
• @repowarden fix-tests — Analyze CI failures and push a fix
• @repowarden resolve-comments — Address review feedback and push updates

RepoWarden Checklist

• Dependencies updated
• Lock file regenerated
• CI passing
• Ready to merge

---

Note: The following dependencies were rolled back because they caused build failures:

• typescript

These will be retried in a future scan.

---

Security Vulnerabilities Resolved

• 🔴 handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block (CVE-2026-33938) — severity: high
• 🚨 handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion (CVE-2026-33937) — severity: critical
• 🟡 handlebars: Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection (CVE-2026-33916) — severity: moderate
• 🟡 handlebars: Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry — severity: moderate
• 🟡 handlebars: Handlebars.js has a Property Access Validation Bypass in container.lookup — severity: low
• 🔴 handlebars: Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options (CVE-2026-33941) — severity: high
• 🔴 handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial (CVE-2026-33940) — severity: high
• 🔴 handlebars: Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation (CVE-2026-33939) — severity: high
• 🟡 hono: Hono missing validation of cookie name on write path in setCookie() — severity: moderate
• 🟡 hono: Hono: Non-breaking space prefix bypass in cookie name handling in getCookie() (CVE-2026-39410) — severity: moderate
• 🟡 hono: Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses (CVE-2026-39409) — severity: moderate
• 🟡 hono: Hono: Path traversal in toSSG() allows writing files outside the output directory (CVE-2026-39408) — severity: moderate
• 🟡 hono: Hono: Middleware bypass via repeated slashes in serveStatic (CVE-2026-39407) — severity: moderate

Remaining vulnerabilities: 23

---

Supply Chain Safety Report

Skipped (unsafe):

• ts-jest@29.4.9
  • 🚨 Package maintainer changed recently: "anhpnnd" -> "GitHub Actions" (version 29.4.9 published 2026-04-01). This could indicate a supply chain attack.

Warnings (upgraded with caution):

• knex@3.2.9
  • ⚠️ Package name "knex" is very similar to popular package "next" (edit distance: 2). Verify this is the intended package.
• @types/node@25.6.0
  • ⚠️ Package name "@types/node" is very similar to popular package "zod" (edit distance: 2). Verify this is the intended package.

---

Supply chain safety: The following packages were skipped due to safety concerns:

• ts-jest@29.4.9: Package maintainer changed recently: "anhpnnd" -> "GitHub Actions" (version 29.4.9 published 2026-04-01). This could indicate a supply chain attack.

[repowarden-app]

This PR has been open for 14 days without being merged, so I'm closing it.

If there was an issue with these changes, please reply with feedback so I can improve!

— RepoWarden

[repowarden-app]

Thanks for reviewing this PR! Since it was closed without merging, I'd love to understand what went wrong so I can improve.

Please reply to this comment with any feedback — for example:

• Were the changes incorrect?
• Was the PR unnecessary?
• Did it miss something important?

Your feedback helps RepoWarden get better. 🙏

— RepoWarden