chore(deps): land bot dependency bumps in one consolidated lockfile

[h4yfans]

Consolidates five stale bot PRs into a single change against current main. Each of them was 162–348 commits behind and every one touched pnpm-lock.yaml, so merging them in sequence would have meant eight rounds of conflict resolution and a real risk of landing a lockfile that no longer matched the manifests. This is one coherent regen instead.

What landed

Source	Change
#1197	prettier ^3.8.3 → ^3.9.6
#1190	ip-address override >=10.1.1 → >=10.3.1 (security) — resolves 10.5.0
#1189	hono override >=4.12.27 → >=4.12.34 (security) — resolves 4.13.1
#1194	nanoid@>=4.0.0 <5.0.9 override 5.0.9 → 5.1.16
#1196	landing: framer-motion → motion ^12.24.7

The motion swap needed more than the bot did

#1196 replaced the package in apps/landing/package.json but left all 49 from 'framer-motion' imports in place. Once framer-motion is off the manifest those no longer resolve, so this repoints them at motion/react and fixes the manualChunks entry in apps/landing/vite.config.ts that still named the old package.

Deliberately left out

• build(deps): bump nanoid from 5.1.16 to 6.0.0 #1193 (nanoid 5.1.16 → 6.0.0) — a major on a direct dependency of desktop and app-core.
• chore(deps): update dependency nanoid@>=3.0.0 <3.3.8 to v5 [security] #1195 (nanoid@>=3.0.0 <3.3.8 → v5) — forces a 3.x transitive onto an ESM-only major.

Both advisories are already closed by the pins currently on main (3.3.8 / 5.0.9→5.1.16), so these two add breakage risk without security value. Left open for a separate call.

Already obsolete

• chore(deps): bump protobufjs from 7.6.3 to 7.6.5 in /packages/importers #813 (protobufjs 7.6.5) — main already has "protobufjs": "7.6.5" and the override >=7.6.5 <8.
• chore(deps): bump hono from 4.12.33 to 4.12.34 #944 (hono 4.12.34) — same version chore(deps): update dependency hono to v4.12.34 [security] #1189 delivers, and its manifest edit assumes 4.12.33 where main has ^4.12.27.

Verification

• pnpm install --frozen-lockfile → Already up to date (no ERR_PNPM_OUTDATED_LOCKFILE); lockfile diff is 41/41 lines, no incidental package sweep
• pnpm --filter @memry/landing build → pass (typecheck + vite build + prerender) — this is the real proof for the motion migration
• pnpm typecheck → pass · pnpm lint → pass · git diff --check → clean
• pnpm test → 8/8 tasks successful: desktop 1242 passed/1 skipped, sync-server 60, contracts 50, i18n 11, sync-harness 5

Pre-existing and untouched by this branch: apps/landing/src/pages/Checkout.tsx fails react-hooks/set-state-in-effect under pnpm --filter @memry/landing lint. The file is byte-identical to origin/main and fails there too.

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 6a41dd8.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!