chore(deps): refresh dependencies, base image and drop dead packages

[BatLeDev]

Dependency refresh pass: measure, security, free wins, proven majors, and documented refusals for the rest.

Security. npm audit was already at 0 on both trees, but the trivy scan of the published images showed everything was hiding elsewhere: the alpine layer and the base image's npm.

Image	Before (6.2.0)	After
api — alpine	2 CRITICAL / 19 HIGH	0
api — node_modules	1 CRITICAL / 42 HIGH	4 HIGH
worker — alpine	15 CRITICAL / 80 HIGH	0
worker — node_modules	2 CRITICAL / 42 HIGH	4 HIGH

node:24.11.1-alpine3.22 → node:24.20.0-alpine3.23 with apk upgrade --no-cache (as on data-fair master), plus npm update, which clears every application-level finding. The 4 remaining HIGH are in the bundled npm: the worker needs it for npm rebuild on plugins with native modules, the api for npm config set https-proxy.

Dead dependencies. tar in the worker, never imported — lib-node-registry uses tar-stream. @types/tar and @types/tar-stream go too: tar-stream has shipped its own types since 3.2.1. The only consequence in code, in the 5.2.0 upgrade script: the entry header type is now derived from those types, and pack.entry().end() takes the explicit undefined that the streamx types require.

Majors adopted, each verified against real behaviour rather than its changelog:

• config 4 → 5: resolved config identical on our .mjs files, re-checked inside the alpine image for both api and worker
• nanoid 5 → 6: same exports, same alphabet, same length
• crypto-random-string 5 → 6: the url-safe alphabet gains . and ~, both unreserved in the query string where the webhookKey lands — only newly generated keys change shape, existing ones stay valid
• @vueuse/core 13 → 14, unplugin-auto-import 19 → 21, unplugin-vue-components 28 → 32: UI build and vue-tsc green
• @types/multer 1 → 2 (multer is already on 2.x), @types/nodemailer 6 → 8

This aligns config, nanoid, @vueuse/core, unplugin-* and @types/multer with data-fair master.

Declined, with the precise blocker:

• croner 9 → 10 rejects the N/step syntax that toCRON() (shared/runs.ts) emits for every stepped field. Compared over 60,000 cases: 47,040 diffs are that error, only 5 are a real divergence (resolution of the ambiguous hour on the DST fall-back). Migrating means rewriting toCRON() to min-59/step — not */step, which shifts the offset: 15/20 is 15,35,55 whereas */20 is 0,20,40. That changes already-stored schedulings → dedicated PR.
• mongodb 6 → 7: staying on 6 to remain aligned with data-fair, catalogs and events.

Undeclared dependencies. Five dependencies that were imported but only resolved through hoisting are now declared the way the sister repos declare them: debug in api (the worker already declared it), ofetch in ui (as in data-fair and events), fs-extra in shared, mongodb in worker — an optional peer of lib-node that worker/src/mongo.ts needs at runtime, declared the same way by catalogs/worker — and mongodb as a devDependency of shared, which only imports its types (a runtime dep there would reach up to the ui, which depends on shared).

Two others are deliberately left undeclared: @data-fair/lib-express in ui/vite.config.ts (data-fair, catalogs, agents and portals all import it there without declaring it) and fast-deep-equal in ui (same situation in data-fair, catalogs and portals). Fixing them here only would break the uniformity — it is a cross-repo chore.

Heads-up.

• Verified locally: lint, check-types and the unit tests (163 passed) are green. The api/e2e tests did not run — dev environment down. CI must run them with a fresh Vite cache, since unplugin-* changes the module graph.
• apk upgrade --no-cache makes the build non-deterministic over time: two builds of the same Dockerfile will not necessarily produce the same alpine layer. That is the accepted trade-off, aligned with data-fair master.
• The lockfile churn is drift absorption across ~180 packages; the root chokidar 4→3.6.0 is a hoisting inversion, not a downgrade (consumers move to a nested 5.0.0).