chore: manage shared workspace deps through the pnpm catalog (#7)

## Summary

<!-- What does this PR change and why? -->

## OpenSpec

- [ ] This PR implements an OpenSpec change: `<!-- change name -->`
- [ ] No OpenSpec change is needed (small doc/fix, no shipped behavior
change).

## Verification

- [ ] `pnpm verify` passed.
- [ ] A subset was run instead: `<!-- commands -->` because `<!-- reason
-->`.

## Impact Checklist

- [ ] App code (`apps/`, `packages/`)
- [ ] API behavior / OpenAPI contract (`apps/api/src/routes/*.ts`
zod-openapi declarations, `api/openapi.json` via `pnpm gen:openapi`)
- [ ] Database schema or migration (`packages/db`)
- [ ] Deployment (`deployment/`)
- [ ] Documentation (`README.md`, `docs/`, `wiki/`)
- [ ] CI / scripts (`.github/workflows/`, `scripts/`, `package.json`)
- [ ] Secret handling: no real `.env`, tokens, cookies, private keys,
database URLs, or user data committed.

## Migration / Deployment Notes

<!-- If this PR affects schema, data migration, or production
deployment, describe the runbook steps. Otherwise write "None". -->

Author: fengmk2

apps/api/package.json

@@ -20,31 +20,31 @@
     "@hono/zod-validator": "^0.4.0",
     "@react-email/render": "2.1.0",
     "ali-oss": "^6.21.0",
-    "bcryptjs": "^2.4.3",
+    "bcryptjs": "catalog:",
     "dotenv": "^17.4.2",
-    "drizzle-orm": "^0.39.0",
+    "drizzle-orm": "catalog:",
     "hono": "^4.12.32",
     "ioredis": "^5.4.0",
     "lodash": "^4.18.1",
     "micromark": "4.0.2",
     "nodemailer": "^7.0.0",
-    "react": "19.2.8",
-    "react-dom": "19.2.8",
+    "react": "catalog:",
+    "react-dom": "catalog:",
     "react-email": "6.9.1",
     "undici": "^8.8.0",
-    "uuid": "^11.0.0",
-    "zod": "^4.4.3"
+    "uuid": "catalog:",
+    "zod": "catalog:"
   },
   "devDependencies": {
-    "@types/bcryptjs": "^2.4.6",
+    "@types/bcryptjs": "catalog:",
     "@types/lodash": "^4.17.24",
-    "@types/node": "^24.0.0",
+    "@types/node": "catalog:",
     "@types/nodemailer": "^8.0.0",
-    "@types/react": "19.2.2",
-    "@types/react-dom": "19.2.3",
-    "@types/uuid": "^10.0.0",
-    "tsx": "^4.19.0",
-    "typescript": "^7.0.0",
+    "@types/react": "catalog:",
+    "@types/react-dom": "catalog:",
+    "@types/uuid": "catalog:",
+    "tsx": "catalog:",
+    "typescript": "catalog:",
     "vite": "catalog:",
     "vite-plus": "catalog:"
   }

apps/web/package.json

@@ -28,8 +28,8 @@
     "isbot": "^5.1.0",
     "lucide-react": "^1.25.0",
     "next-themes": "^0.4.6",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0",
+    "react": "catalog:",
+    "react-dom": "catalog:",
     "react-hook-form": "^7.82.0",
     "react-markdown": "^10.1.0",
     "react-router": "^7.18.0",
@@ -40,7 +40,7 @@
     "sonner": "^2.0.7",
     "swagger-ui-react": "^5.32.11",
     "tailwind-merge": "^3.6.0",
-    "zod": "^4.4.3",
+    "zod": "catalog:",
     "zustand": "^5.0.14"
   },
   "devDependencies": {
@@ -50,14 +50,14 @@
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/react": "^19.1.0",
-    "@types/react-dom": "^19.1.0",
+    "@types/react": "catalog:",
+    "@types/react-dom": "catalog:",
     "@types/swagger-ui-react": "^5.18.0",
     "jsdom": "^29.1.1",
     "shadcn": "4.16.1",
     "tailwindcss": "^4.0.0",
     "tw-animate-css": "1.4.0",
-    "typescript": "^7.0.0",
+    "typescript": "catalog:",
     "vite": "catalog:",
     "vite-plus": "catalog:",
     "vitest": "catalog:",

package.json

@@ -31,14 +31,14 @@
   "dependencies": {
     "@cnode/shared": "workspace:*",
     "mongodb": "^5.9.2",
-    "pg": "^8.22.0"
+    "pg": "catalog:"
   },
   "devDependencies": {
     "@fission-ai/openspec": "1.6.0",
-    "@types/pg": "^8.20.0",
+    "@types/pg": "catalog:",
     "concurrently": "^9.1.0",
-    "tsx": "^4.23.1",
-    "typescript": "^7.0.0",
+    "tsx": "catalog:",
+    "typescript": "catalog:",
     "vite": "catalog:",
     "vite-plus": "catalog:"
   },

packages/db/package.json

@@ -21,18 +21,18 @@
   },
   "dependencies": {
     "@cnode/shared": "workspace:*",
-    "bcryptjs": "^2.4.3",
-    "drizzle-orm": "^0.39.0",
-    "pg": "^8.13.0",
-    "uuid": "^11.0.0"
+    "bcryptjs": "catalog:",
+    "drizzle-orm": "catalog:",
+    "pg": "catalog:",
+    "uuid": "catalog:"
   },
   "devDependencies": {
-    "@types/bcryptjs": "^2.4.6",
-    "@types/node": "^24.0.0",
-    "@types/pg": "^8.11.0",
-    "@types/uuid": "^10.0.0",
+    "@types/bcryptjs": "catalog:",
+    "@types/node": "catalog:",
+    "@types/pg": "catalog:",
+    "@types/uuid": "catalog:",
     "drizzle-kit": "^0.30.0",
-    "tsx": "^4.19.0",
-    "typescript": "^7.0.0"
+    "tsx": "catalog:",
+    "typescript": "catalog:"
   }
 }

packages/shared/package.json

@@ -17,10 +17,10 @@
   },
   "dependencies": {
     "decode-named-character-reference": "1.3.0",
-    "zod": "^4.4.3"
+    "zod": "catalog:"
   },
   "devDependencies": {
-    "@types/node": "^24.0.0",
-    "typescript": "^7.0.0"
+    "@types/node": "catalog:",
+    "typescript": "catalog:"
   }
 }