[cliffhall]

Closes #2861

The November dependency refresh: every in-range (wanted) bump from the sweep, plus the in-major action pin bumps. npm audit shows only the moderate minimatch chain in the lint toolchain, which is #2863 and is handled separately.

In-range npm bumps (targeted npm update <pkg> per install)

• root: @hono/node-server 2.1.5, @napi-rs/keyring 2.1.2, eslint 10.14.0, hono 4.13.16, react 19.3.1, typescript-eslint 8.72.1, vite 8.3.5. Also three in-range bumps published after the sweep ran: @vitejs/plugin-react 6.2.1, globals 17.14.0, semver 7.8.6.
• web: Storybook 10.6.5 (all addons + eslint-plugin-storybook), @chromatic-com/storybook 5.6.0, @testing-library/user-event 14.6.8, ace-builds 1.45.2, playwright 1.64.1, react-dom 19.3.1, tsdown 0.23.5, vite 8.3.5, @vitejs/plugin-react 6.2.1.
• cli / mcpdo: tsdown 0.23.5. tui: tsdown 0.23.5, vite 8.3.5.
• Peer/transitive shadows aligned for verify:dep-lockstep: eslint + react in tui, eslint + semver in web.

rolldown override 1.2.13 → 1.2.16 (all four clients)

The root's Vite 8.3.5 resolves Rolldown 1.2.16, and tsdown 0.23.5 requires ~1.2.16, so the clients' rolldown overrides (#1492/#2797) had to move with it. docs/tsdown-migration.md already predicted this ("those overrides have to move whenever the root's Vite moves Rolldown"); its banner note is updated to say which version the repo builds with now. verify:bundle-externals accepts both banner forms and passed.

Action pins (credentialed jobs, SHA + # vX.Y.Z from one action:resolve-pin lookup each)

actions/download-artifact 8.0.2, actions/setup-node 7.1.0, actions/upload-artifact 7.0.2, docker/login-action 4.7.0, github/codeql-action/{init,analyze} 4.39.3 (newer than the sweep's 4.39.1). verify:action-pins OK.

Not taken

• Majors: @types/node 26, vitest/@vitest/coverage-v8/@vitest/browser-playwright 5 (cut web coverage scope, Coverage gate passes when its include globs stop matching: guard the measured file set #2709), chokidar 6, ink 8, ink-scroll-view 0.4 (0.x minor is a breaking change), pino 10, typescript 7, Mantine 9, @dnd-kit/sortable 10, @testing-library/jest-dom 7. Same reasoning as the #2557 analysis; none has changed.
• prettier 3.9.x: an exact pin (chore: pin prettier to an exact version (the ^3.8.1 caret lets an in-range bump fail the format gate on untouched files) #1790), and a minor that reformats. It belongs in its own PR with its formatting diff.
• anthropics/claude-code-action v1.0.266: it runs next to ANTHROPIC_API_KEY in sdk-watch.yml, and the 31 intervening releases were not reviewed. Same call as chore(deps): monthly dependency refresh #2557.
• @modelcontextprotocol/ext-tasks 0.2.3: published after the sweep. SDK packages are tracked by the nightly SDK watch, which files its own issue with an analysis.

Verification

npm run local:gate green on this HEAD: all suites, coverage, smokes, Storybook 123/123, verify:dep-lockstep OK (17 declared dependencies agree across 6 installs).

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues remain for the dependency and GitHub Actions refresh.

No open issues 🎉

4 files not reviewed

• clients/cli/package-lock.json: Generated file
• clients/mcpdo/package-lock.json: Generated file
• clients/tui/package-lock.json: Generated file
• clients/web/package-lock.json: Generated file

What changed in this PR

Refreshes Inspector’s runtime and development dependencies for November under #2861, while keeping major upgrades and the minimatch advisory fix in separate work.

Changes:

• Updates in-range dependencies and aligns shared dependency versions across installs.
• Raises all four client Rolldown overrides to 1.2.16 and documents the current bundler version.
• Refreshes pinned GitHub Actions for packaging, publishing, security scanning, and automation.

File	Description
package-lock.json	Updates shared runtime dependencies and root tooling.
docs/​tsdown-migration.md	Documents Rolldown 1.2.16 usage and banner history.
clients/​web/​package.json	Pins the Rolldown override to 1.2.16.
clients/​tui/​package.json	Pins the Rolldown override to 1.2.16.
clients/​tui/​package-lock.json	Updates bundling tools and aligns React and ESLint.
clients/​mcpdo/​package.json	Pins the Rolldown override to 1.2.16.
clients/​mcpdo/​package-lock.json	Updates tsdown, Rolldown, and related dependencies.
clients/​cli/​package.json	Pins the Rolldown override to 1.2.16.
clients/​cli/​package-lock.json	Updates tsdown, Rolldown, and related dependencies.
.github/​workflows/​sdk-watch.yml	Refreshes artifact upload and download pins.
.github/​workflows/​main.yml	Refreshes Node setup, artifact, and container login pins.
.github/​workflows/​dependabot-alerts.yml	Refreshes the Node setup pin.
.github/​workflows/​codeql.yml	Updates both CodeQL action pins to 4.39.3.

_{Review effort: Balanced}

[cliffhall]

Copilot review closed: round 1 was clean (no inline comments, no headline findings, no suppressed comments), so the loop stopped on the first clean round.