chore: deps update (#11981)

# Which Problems Are Solved

After merging #11968 and rechecking the dependabot alerts there are
still some issues leftover.

# How the Problems Are Solved

This pr makes overrides for vulnerable transitive depdencies to force
update to safe versions.
It also upgrades the next.js version in the docs and I also ran `pnpm
update` once more.

# Additional Changes

Removed the mochaawesome dependency is this is not really needed and
seems unmaintained.

# Additional Context

- Precursor: #11968

apps/docs/package.json

@@ -23,29 +23,29 @@
   },
   "dependencies": {
     "@headlessui/react": "^2.2.9",
-    "@heroicons/react": "2.2.0",
+    "@heroicons/react": "^2.2.0",
-    "@inkeep/cxkit-react": "^0.5.115",
+    "@inkeep/cxkit-react": "^0.5.116",
     "@scalar/api-reference": "^1.49.8",
-    "@shikijs/rehype": "^3.23.0",
+    "@shikijs/rehype": "^4.0.2",
-    "@shikijs/types": "^3.23.0",
+    "@shikijs/types": "^4.0.2",
     "@types/js-yaml": "^4.0.9",
-    "clsx": "2.1.1",
+    "clsx": "^2.1.1",
-    "fumadocs-core": "16.6.15",
+    "fumadocs-core": "16.7.9",
-    "fumadocs-mdx": "14.2.9",
+    "fumadocs-mdx": "14.2.11",
-    "fumadocs-openapi": "10.3.18",
+    "fumadocs-openapi": "10.6.3",
-    "fumadocs-ui": "16.6.15",
+    "fumadocs-ui": "16.7.9",
     "js-yaml": "^4.1.1",
-    "lucide-react": "^0.574.0",
+    "lucide-react": "^0.577.0",
     "mixpanel-browser": "^2.77.0",
-    "next": "16.1.6",
+    "next": "16.2.2",
     "next-themes": "^0.4.6",
-    "react": "^19.2.4",
+    "react": "19.2.4",
     "react-copy-to-clipboard": "^5.1.1",
-    "react-dom": "^19.2.4",
+    "react-dom": "19.2.4",
     "react-google-charts": "^5.2.1",
-    "shiki": "^3.23.0",
+    "shiki": "^4.0.2",
     "tailwind-merge": "^3.5.0",
-    "vanilla-cookieconsent": "3.1.0",
+    "vanilla-cookieconsent": "^3.1.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
@@ -54,8 +54,8 @@
     "@tailwindcss/typography": "^0.5.19",
     "@types/mdx": "^2.0.13",
     "@types/node": "^25.5.0",
-    "@types/react": "^19.2.14",
+    "@types/react": "19.2.14",
-    "@types/react-dom": "^19.2.3",
+    "@types/react-dom": "19.2.3",
     "@typescript-eslint/eslint-plugin": "^8.58.0",
     "@typescript-eslint/parser": "^8.58.0",
     "eslint": "^10.1.0",

apps/login/package.json

@@ -44,7 +44,7 @@
     "lucide-react": "^0.577.0",
     "moment": "^2.30.1",
     "next": "16.2.2",
-    "next-intl": "^4.8.4",
+    "next-intl": "^4.9.0",
     "next-themes": "^0.4.6",
     "nice-grpc": "^2.1.14",
     "qrcode.react": "^4.2.0",
@@ -65,7 +65,7 @@
     "@otplib/core": "^12.0.1",
     "@otplib/plugin-crypto": "^12.0.1",
     "@otplib/plugin-thirty-two": "^12.0.1",
-    "@playwright/test": "^1.59.0",
+    "@playwright/test": "^1.59.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
@@ -85,7 +85,7 @@
     "concurrently": "^9.2.1",
     "dotenv-cli": "^11.0.0",
     "env-cmd": "^11.0.0",
-    "esbuild": "^0.27.4",
+    "esbuild": "^0.27.5",
     "eslint": "^10.1.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",

console/package.json

@@ -13,18 +13,18 @@
   },
   "private": true,
   "dependencies": {
-    "@angular/animations": "^21.2.6",
+    "@angular/animations": "^21.2.7",
-    "@angular/cdk": "^21.2.4",
+    "@angular/cdk": "^21.2.5",
-    "@angular/common": "^21.2.6",
+    "@angular/common": "^21.2.7",
-    "@angular/compiler": "^21.2.6",
+    "@angular/compiler": "^21.2.7",
-    "@angular/core": "^21.2.6",
+    "@angular/core": "^21.2.7",
-    "@angular/forms": "^21.2.6",
+    "@angular/forms": "^21.2.7",
-    "@angular/material": "^21.2.4",
+    "@angular/material": "^21.2.5",
-    "@angular/material-moment-adapter": "^21.2.4",
+    "@angular/material-moment-adapter": "^21.2.5",
-    "@angular/platform-browser": "^21.2.6",
+    "@angular/platform-browser": "^21.2.7",
-    "@angular/platform-browser-dynamic": "^21.2.6",
+    "@angular/platform-browser-dynamic": "^21.2.7",
-    "@angular/router": "^21.2.6",
+    "@angular/router": "^21.2.7",
-    "@angular/service-worker": "^21.2.6",
+    "@angular/service-worker": "^21.2.7",
     "@bufbuild/protobuf": "^2.11.0",
     "@connectrpc/connect": "^2.1.1",
     "@connectrpc/connect-web": "^2.1.1",
@@ -51,7 +51,7 @@
     "moment": "^2.30.1",
     "ngx-color": "^10.1.0",
     "opentype.js": "^1.3.4",
-    "posthog-js": "^1.364.5",
+    "posthog-js": "^1.364.6",
     "rxjs": "^7.8.2",
     "tinycolor2": "^1.6.0",
     "tslib": "^2.8.1",
@@ -64,8 +64,8 @@
     "@angular-eslint/template-parser": "21.3.0",
     "@angular/build": "^21.2.6",
     "@angular/cli": "^21.2.6",
-    "@angular/compiler-cli": "^21.2.6",
+    "@angular/compiler-cli": "^21.2.7",
-    "@angular/language-service": "^21.2.6",
+    "@angular/language-service": "^21.2.7",
     "@eslint/js": "^10.0.1",
     "@types/file-saver": "^2.0.7",
     "@types/google-protobuf": "^3.15.12",

deploy/compose/package.json

@@ -2,7 +2,7 @@
   "name": "@zitadel/compose",
   "private": true,
   "devDependencies": {
-    "@playwright/test": "^1.59.0",
+    "@playwright/test": "^1.59.1",
     "dotenv": "^16.0.0"
   }
 }

package.json

@@ -2,14 +2,6 @@
   "packageManager": "[email protected]",
   "private": true,
   "name": "@zitadel/zitadel",
-  "pnpm": {
-    "overrides": {
-      "form-data@>=4.0.0 <4.0.4": ">=4.0.4",
-      "csstype": "3.1.3",
-      "tar@<7.5.3": ">=7.5.3",
-      "rollup@>=4.0.0 <4.59.0": ">=4.59.0"
-    }
-  },
   "scripts": {
     "changeset": "changeset",
     "clean:all": "pnpm run clean && rm -rf .nx node_modules"
@@ -17,7 +9,7 @@
   "devDependencies": {
     "@bufbuild/buf": "^1.66.1",
     "@changesets/cli": "^2.30.0",
-    "nx": "21.6.9",
+    "nx": "21.6.10",
     "sass": "^1.98.0",
     "shiki": "^3.23.0",
     "wait-on": "^9.0.4"

packages/zitadel-client/knip.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://unpkg.com/knip@5/schema.json",
+  "$schema": "https://unpkg.com/knip@6/schema.json",
   "ignoreDependencies": [
     "@zitadel/proto"
   ]

packages/zitadel-client/package.json

@@ -89,7 +89,7 @@
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import": "^2.32.0",
     "globals": "^17.4.0",
-    "knip": "^5.88.1",
+    "knip": "^6.2.0",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.2"

pnpm-workspace.yaml

@@ -9,4 +9,17 @@ exclude:
   - benchmark # because of the node 18 or 20 dependency
 
 overrides:
-  "js-yaml@^4": ">=4.1.1"
+  "tar@<7.5.11": "^7.5.11 <8.0.0"
+  "flatted@<3.4.2": "^3.4.2"
+  "rollup@>=4.0.0 <4.59.0": "^4.59.0"
+  "socket.io-parser@>=4.0.0 <4.2.6": "^4.2.6"
+  "picomatch@>=4.0.0 <4.0.4": "^4.0.4"
+  "lodash@>=4.0.0 <4.18.0": "^4.18.0"
+  "js-yaml@<3.14.2": "^3.14.2"
+  "qs@<6.14.2": "^6.14.2"
+  "ajv@<6.14.0": "^6.14.0"
+  "minimatch@<3.1.4": "^3.1.4"
+  "dompurify@>=3.1.3 <3.3.2": "^3.3.2"
+  "unhead@<2.1.11": "^2.1.11"
+  "fast-xml-parser@>=4.0.0 <5.5.7": "^5.5.7"
+  "brace-expansion@<1.1.13": "^1.1.13"

tests/functional-ui/cypress.config.ts

@@ -38,7 +38,6 @@ let webhookEvents = new Array<ZITADELWebhookEvent>()
 let failWebhookEventsCount = 0
 
 export default defineConfig({
-  reporter: 'mochawesome',
   video: true,
   reporterOptions: {
     overwrite: false,

tests/functional-ui/package.json

@@ -9,10 +9,9 @@
   "private": true,
   "devDependencies": {
     "@types/node": "^25.5.0",
-    "cypress": "^14.5.4",
+    "cypress": "^15.13.0",
     "cypress-wait-until": "^3.0.2",
     "jsonwebtoken": "^9.0.3",
-    "mochawesome": "^7.1.4",
     "prettier": "^3.8.1",
     "typescript": "^5.9.3",
     "uuid": "^13.0.0"