chore(deps-dev): bump the npm dependencies

scripts/normalize-yarn-lock.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { stderr, stdout } = require("node:process");
+
+const lockFilePath = process.argv[2];
+
+if (!lockFilePath) {
+  stderr.write("Usage: normalize-yarn-lock.js <yarn.lock path>\n");
+  process.exit(1);
+}
+
+const absoluteLockFilePath = path.resolve(lockFilePath);
+
+if (!fs.existsSync(absoluteLockFilePath)) {
+  stdout.write(`No lockfile found at ${lockFilePath}\n`);
+  process.exit(0);
+}
+
+// Mirrors Yarn Classic's own `shouldWrapKey` so we quote exactly the keys that
+// Yarn's lockfile tokenizer would otherwise misread. Yarn treats any bare token
+// starting with `true`/`false` as a boolean literal, so keys such as
+// `true-case-path` must be quoted. Tools like yarn-audit-fix (via synp) emit
+// these dependency keys unquoted, producing a lockfile Yarn cannot parse.
+function shouldWrapKey(key) {
+  return (
+    key.indexOf("true") === 0 ||
+    key.indexOf("false") === 0 ||
+    /[:\s\n\\",[\]]/.test(key) ||
+    /^[0-9]/.test(key) ||
+    !/^[a-zA-Z]/.test(key)
+  );
+}
+
+const original = fs.readFileSync(absoluteLockFilePath, "utf8");
+
+// Dependency reference lines look like `    <name> "<range>"`. Only unquoted
+// keys (no leading quote) can be malformed, so leave already-quoted keys alone.
+const dependencyLine = /^(\s+)([^\s"][^\s]*)(\s+"[^"]*")\s*$/;
+
+let fixedCount = 0;
+const normalized = original
+  .split("\n")
+  .map((line) => {
+    const match = line.match(dependencyLine);
+
+    if (!match) {
+      return line;
+    }
+
+    const [, indent, key, rest] = match;
+
+    if (!shouldWrapKey(key)) {
+      return line;
+    }
+
+    fixedCount += 1;
+    return `${indent}"${key}"${rest}`;
+  })
+  .join("\n");
+
+if (fixedCount === 0) {
+  stdout.write("Yarn lockfile already normalized\n");
+  process.exit(0);
+}
+
+fs.writeFileSync(absoluteLockFilePath, normalized);
+stdout.write(
+  `Normalized ${fixedCount} Yarn lockfile key${fixedCount === 1 ? "" : "s"}\n`,
+);

scripts/test-packages.sh

@@ -54,7 +54,7 @@ has_yarn_resolutions() {
 yarn_has_direct_dependency_updates() {
 	pkg_dir="$1"
 	updates_json="$(
-		cd "$pkg_dir" && npm exec --yes npm-check-updates@latest -- --packageFile package.json --jsonUpgraded --loglevel silent 2>/dev/null
+		cd "$pkg_dir" && npm exec --yes npm-check-updates@latest -- --packageFile package.json --jsonUpgraded 2>/dev/null
 	)"
 
 	case "$(printf '%s' "$updates_json" | tr -d '[:space:]')" in
@@ -74,7 +74,12 @@ run_interactive_update_for_pm() {
 		fi
 		run_install_for_pm "$pkg_dir" "$pm"
 		;;
-	pnpm) (cd "$pkg_dir" && run_with_terminal_input corepack pnpm update --interactive --latest) ;;
+	pnpm)
+		if ! (cd "$pkg_dir" && run_with_terminal_input corepack pnpm update --interactive --latest); then
+			return 1
+		fi
+		(cd "$pkg_dir" && corepack pnpm install --no-frozen-lockfile)
+		;;
 	yarn)
 		resolutions_updated=0
 
@@ -118,8 +123,12 @@ run_audit_fix_for_pm() {
 		;;
 	yarn)
 		run_install_for_pm "$pkg_dir" "$pm"
-		echo "yarn audit in $pkg_dir"
-		(cd "$pkg_dir" && corepack yarn audit)
+		echo "yarn-audit-fix in $pkg_dir"
+		if ! (cd "$pkg_dir" && npm exec --yes yarn-audit-fix@latest); then
+			return 1
+		fi
+		node "$script_dir/normalize-yarn-lock.js" "$pkg_dir/yarn.lock"
+		run_install_for_pm "$pkg_dir" "$pm"
 		;;
 	esac
 }

tests/npm/package.json

@@ -11,7 +11,7 @@
   "devDependencies": {
     "gatsby": "^5.16.1",
     "jest": "^30.5.2",
-    "nx": "^24.0.0",
+    "nx": "^24.0.1",
     "prettier": "^3.9.10",
     "storybook": "^10.6.3"
   },

tests/pnpm-package-manager/package.json

@@ -9,7 +9,7 @@
   "devDependencies": {
     "gatsby": "^5.16.1",
     "jest": "^30.5.2",
-    "nx": "^24.0.0",
+    "nx": "^24.0.1",
     "prettier": "^3.9.10",
     "storybook": "^10.6.3"
   },