Dependabot: 9 bumps deferred pending migration (sweep 2026-06-23)

[rz1989s]

Dependabot sweep on 2026-06-23. 6 safe bumps were adopted (#339 docker/login-action, #340 ssh-agent, #341 pnpm/action-setup, #323 setup-node, #327 upload-artifact, #333 @types/supertest). The 9 below each fail CI against current main (real breaking changes, not staleness) or need ecosystem-specific verification — each is a real migration, deferred here with the diagnosis + fix hint so it can be picked up cleanly. PRs left open so Dependabot keeps them current.

Progress — 2026-06-23: @noble/hashes 1→2 migrated and merged (#345) — 8 deferred remain.

Needs code migration (CI verified-failing on current main)

• build(deps): bump @noble/hashes from 1.8.0 to 2.2.0 #335 @noble/hashes 1.8.0→2.2.0 — ✅ DONE via chore(deps): migrate @noble/hashes 1.x → 2.x #345. Bigger than triaged: v2 dropped all bare subpath exports (not just sha256/sha512→sha2), so every import moved to the .js-suffixed sha2.js/sha3.js/utils.js paths — 22 sites across root API + @sipher/sdk + @sipher/agent. Merged with NIST/Keccak known-answer characterization tests proving byte-identical output on both v1 and v2. Confirmed all three packages resolve @noble/hashes@2.2.0; the @sip-protocol/sdk transitive 1.x coexists harmlessly. Superseded Dependabot build(deps): bump @noble/hashes from 1.8.0 to 2.2.0 #335.
• build(deps): bump zod from 3.25.76 to 4.4.3 #332 zod 3→4 — error.errors → error.issues (src/middleware/validation.ts:29) + general zod 4 migration (defaults, error formats). Verify all schema validation paths.
• build(deps-dev): bump vitest from 3.2.4 to 4.1.9 #331 vitest 3→4 — test runtime error; vitest 4 config/API migration.
• build(deps-dev): bump @vitejs/plugin-react from 4.7.0 to 6.0.2 #336 @vitejs/plugin-react 4→6 — app build/e2e fails (dist/app.js not produced); Vite plugin major.
• build(deps): bump pino-http from 10.5.0 to 11.0.0 #330 pino-http 10→11 — No overload matches this call (src/logger.ts:26); logger options API change.
• build(deps): bump the minor-and-patch group across 1 directory with 25 updates #342 minor/patch group (25 updates) — one update bumped a TypeBox-related dep that changed TSchema; tests/pi/tool-adapter.test.ts accesses .type/.properties/.required on it → typecheck fails. Adapt the test's TSchema access, or have Dependabot re-group excluding the breaking update to land the other 24.

Needs ecosystem-specific verification (not covered by PR CI)

• build(deps-dev): bump jsdom from 25.0.1 to 29.1.1 #334 jsdom 25→29 — dev dep, only a pnpm-lock.yaml conflict (no code change). Re-resolve the lockfile + merge.
• build(deps): bump node from 22-alpine to 26-alpine #328 node 22→26-alpine — Docker base image. The Docker build runs only on the main deploy, not on PRs, so green PR CI does NOT verify it. Run docker build locally before merging.
• build(deps): update reqwest requirement from ^0.12 to ^0.13 in /sdks/rust #322 reqwest 0.12→0.13 (/sdks/rust) — Rust HTTP lib. Verify cargo build / cargo test in the Rust SDK.