chore(deps): take #26556's dev-dependency bumps, minus focus-scope and playwright (#27072)

<!-- claude-projects-attribution: {"github_login":"os-tesla"} -->
_Requested by **Tesla** · [project
thread](https://claude.ai/code/project/chan_01AXsQkLFKRdQCqQ3RTr6Jao?thread=cmsg_01AXsQkLFKRdQCqQ3RTr6JaoPj8AEeY2Kbt35GAb4BGUDJ)_

Supersedes #26556 (Dependabot's development-dependencies group, red on
Test UI).

## 维护者速读

- **改了什么:** 把 Dependabot #26556 里的开发依赖升级在当前 main
上重做一遍（eslint、typescript-eslint、turbo、@types/node、vite-plugin-dts、react-router-dom
等），只动 devDependencies 和 lockfile。另外改了两处脚手架模板的版本号，并在 dependabot.yml 加了
ignore。
- **为什么改:** 常规工具链保鲜。#26556
原样合会出两个问题：一是让「弹窗里的查找下拉框无法搜索」那个补丁失效（focus-scope 补丁只认 1.1.16）；二是 lockfile
里出现两份 react-router 和两份 playwright-core。所以这两个包这次不升。
- **风险与回滚:** 不改任何运行时代码，生产依赖一个没动。最大的风险是开发工具小版本的行为变化，CI 全量 65 项已经覆盖。回滚就是
revert 本 PR。
- **先看:** `.github/dependabot.yml` 新增的 ignore
和注释；`ui/packages/cli/src/utils/app-generator.ts`、`ui/packages/create-plugin/src/templates.ts`
各改一个版本号。
- **两分钟验证:** 在仓根跑 `pnpm install --frozen-lockfile`，再跑 `pnpm --dir ui run
check:lockfile-integrity --base-ref origin/main`，应输出 `VERDICT clean`。
- **需要你做的:** 无。席位复核通过后经合并队列落地。
- **席位意见:** ACCEPT。focus-scope 和 playwright 留待手动升级，dependabot
不会再自动提出这两个包。

## What changes

Re-applies #26556's dev-dependency bumps on current `main`, minus two
packages, with the repairs its red shards asked for:

| | |
|---|---|
| taken | `@types/node` 26.6.5, `@typescript-eslint/parser` /
`typescript-eslint` 8.72, `eslint` 10.13, `svelte` range ^5.57.2 (the
root override keeps it on 5.57.1), `turbo` 2.11.10, `mysql2` 3.24.6,
`pg` 8.23.1, `@testing-library/dom` 10.4.2,
`@testing-library/user-event` 14.6.8, `axe-core` 4.14, `concurrently`
10.0.6, `eslint-plugin-react-refresh` 0.5.7, `globals` 17.13,
`react-router-dom` 7.18 (resolves 7.18.5), `typedoc-plugin-markdown`
4.14, `vite-plugin-dts` 5.1, `react-grid-layout` 2.3, `@types/vscode`
1.140 |
| held | `@radix-ui/react-focus-scope` (stays 1.1.16), `playwright` /
`@playwright/test` (stay on their ranges, resolving 1.63.0) |

- **focus-scope held.** `pnpm-workspace.yaml` patches
`@radix-ui/react-focus-scope@1.1.16` exactly: the focus-trap race fix
that keeps a lookup popover's search input focusable inside a Dialog.
#26556's 1.3.1 ships unpatched, and
`ui/packages/components/src/__tests__/dialog-popover-focus-scope.test.tsx`
fails on it (Test UI 4/16 there).
- **playwright held.** `service-print` and `dogfood` pin
`playwright-core` 1.63.0 exactly, matched to the container's chromium
build. Bumping the two ranges alone forks `playwright-core` into two
copies, which `check:lockfile-integrity` (now in Type Check UI) refuses.
- **Lockfile deduped.** The peer-resolved copies of `react-router-dom`
(plugin-detail, plugin-designer), `mysql2` and `pg` stayed on the old
versions after the relock. The second `react-router` copy is what nulled
the router context in `RecordDetailView.recordOpenWaves-13010.test.tsx`
(Test UI 15/16 there). `pnpm dedupe` removed only those old copies.
- **Scaffold ranges follow the workspace** (Test UI 10/16 and 14/16
there): `@object-ui/cli`'s routed app declares `react-router-dom`
`^7.18.4`, and `@object-ui/create-plugin`'s plugin declares
`vite-plugin-dts` `^5.1.2`. Changeset `26556-scaffold-dev-ranges.md`,
patch.
- **`.github/dependabot.yml` ignores** focus-scope and the playwright
trio, each with the reason and the by-hand route, so the next group PR
does not bring them back. (`dependabot.yml` is not a governed surface;
`.github/workflows/**` is untouched.)

## Why

Routine dev-toolchain freshness, without the two bumps that would
regress a patched production fix and fork the browser driver.

## Verification

At head `bb513d428e`, on `main` 3230bdb:

- `pnpm install --frozen-lockfile`: exit 0.
- `pnpm --dir ui run check:lockfile-integrity --base-ref origin/main`:
`VERDICT clean — no package gained a copy.`
- The four tests that were red on #26556, run together from `ui/`: 4
files, 88 tests passed (`dialog-popover-focus-scope`,
`RecordDetailView.recordOpenWaves-13010`, `create-plugin templates`,
`cli app-generator`). Before the dedupe,
`RecordDetailView.recordOpenWaves-13010` reproduced #26556's failure
locally (`Cannot destructure property 'basename'`, two `react-router`
copies).
- The full suites run in CI on this PR.

Clause-②: no
Metadata-protocol: none

## Human Minimum

- [x] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
(no schema change)
- [x] 2. Every name I added uses the casing for its kind.
- [x] 3. No formatter ran; `pnpm lint` passes. (CI)
- [x] 4. One issue, one branch off an up-to-date `main`, one pull
request.
- [x] 5. A change that publishes carries a changeset, and both
declaration lines are filled in here and in the changeset.
- [x] 6. `packages/spec` touched: its generated artifacts are
regenerated and committed. (only its `@types/node` devDependency moved)
- [x] 7. No hand edits to `content/docs/references/`,
`packages/*/CHANGELOG.md` or `content/docs/releases/`.
- [x] 8. Title, body and comments are in English.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01L9qibwmEPoSR8apWBvbyFj

---
_Generated by [Claude
Code](https://claude.ai/code/session_01L9qibwmEPoSR8apWBvbyFj)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/26556-scaffold-dev-ranges.md

@@ -0,0 +1,11 @@
+---
+'@object-ui/cli': patch
+'@object-ui/create-plugin': patch
+---
+
+chore(scaffold): generated apps and plugins declare the dev ranges this repository now builds with
+
+Clause-②: no
+Metadata-protocol: none
+
+The workspace moved `react-router-dom` to `^7.18.4` and `vite-plugin-dts` to `^5.1.2`. A routed app scaffolded by `@object-ui/cli` now declares `react-router-dom` `^7.18.4`, and a plugin scaffolded by `@object-ui/create-plugin` now declares `vite-plugin-dts` `^5.1.2`, so a new project starts on the same versions the in-repo packages are tested on.

.github/dependabot.yml

@@ -10,6 +10,21 @@ updates:
     commit-message:
       prefix: "chore(deps)"
       include: "scope"
+    ignore:
+      # pnpm-workspace.yaml patches this package at one exact version (the
+      # focus-trap race fix that keeps a lookup popover searchable inside a
+      # Dialog). A bump leaves the new version unpatched, so move it by hand:
+      # re-key the patch to the new version and run
+      # ui/packages/components/src/__tests__/dialog-popover-focus-scope.test.tsx.
+      - dependency-name: "@radix-ui/react-focus-scope"
+      # playwright-core is pinned exact (service-print, dogfood) to the chromium
+      # build the container image ships, and playwright / @playwright/test carry
+      # their own playwright-core. Bumping only the two ranges forks
+      # playwright-core into two copies, which check:lockfile-integrity refuses.
+      # Move all three together, by hand, with the browser build.
+      - dependency-name: "playwright"
+      - dependency-name: "@playwright/test"
+      - dependency-name: "playwright-core"
     groups:
       # Group all patch and minor updates together
       development-dependencies:

apps/docs/package.json

@@ -30,7 +30,7 @@
     "@tailwindcss/postcss": "^4.3.3",
     "@types/mdx": "^2.0.14",
     "@types/negotiator": "^0.6.5",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.4",
     "negotiator": "^1.1.0",

examples/embed-objectql/package.json

@@ -15,7 +15,7 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   }

package.json

@@ -218,15 +218,15 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@changesets/cli": "^3.0.3",
-    "@types/node": "^26.6.3",
-    "@typescript-eslint/parser": "^8.70.1",
-    "eslint": "^10.11.0",
+    "@types/node": "^26.6.5",
+    "@typescript-eslint/parser": "^8.72.0",
+    "eslint": "^10.13.0",
     "github-slugger": "2.0.0",
     "semver": "^7.8.5",
-    "svelte": "^5.57.1",
+    "svelte": "^5.57.2",
     "tsup": "^8.5.1",
     "tsx": "^4.23.15",
-    "turbo": "^2.11.5",
+    "turbo": "^2.11.10",
     "typescript": "^6.0.3",
     "yaml": "^2.9.1"
   },

packages/apps/account/package.json

@@ -28,7 +28,7 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"

packages/apps/setup/package.json

@@ -28,7 +28,7 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"

packages/apps/studio/package.json

@@ -28,7 +28,7 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"

packages/cli/package.json

@@ -136,7 +136,7 @@
     "@objectstack/driver-turso": "workspace:*",
     "@objectstack/plugin-dev": "workspace:*",
     "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },

packages/cloud-connection/package.json

@@ -36,7 +36,7 @@
   "devDependencies": {
     "@objectstack/lint": "workspace:*",
     "@objectstack/plugin-security": "workspace:*",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },