chore(deps): update npm dependencies and clean up pnpm overrides (#12592)

# Which Problems Are Solved

Several dependencies across the workspace had fallen behind their latest
patch releases, and the override list in pnpm-workspace.yaml had
drifted: many of the 28 entries were no longer needed because the
dependency tree had already moved past them, while a few enforced
outdated version floors.

# How the Problems Are Solved

Direct dependencies were updated where newer patch releases were
available: `@angular/*` → ^21.2.19, `next` → 16.2.11 (docs and login,
incl. `@next/eslint-plugin-next`), `nx` → 22.7.7, and `js-yaml` → ^4.3.1
/ `postcss` → ^8.5.23 in docs. The lockfile was regenerated from scratch
so all transitive dependencies resolve to the newest versions within
their allowed ranges. With that in place, the override list was rebuilt
down to the 8 entries that are still required because a parent package
pins an older version (axios and brace-expansion via nx, postcss and
sharp via next, esbuild via tsx, uuid via testcontainers, and the two
OpenTelemetry packages); the other 20 overrides were removed. A
verification pass confirmed the resolved versions stay at or above the
floors the removed overrides used to enforce, and `pnpm audit` comes
back clean.

---------

Co-authored-by: Livio Spring <[email protected]>

apps/docs/package.json

@@ -34,10 +34,10 @@
     "fumadocs-mdx": "14.3.2",
     "fumadocs-openapi": "10.8.2",
     "fumadocs-ui": "16.8.10",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.3.1",
     "lucide-react": "^0.577.0",
     "mixpanel-browser": "^2.78.0",
-    "next": "16.2.6",
+    "next": "16.2.11",
     "next-themes": "^0.4.6",
     "react": "19.2.6",
     "react-copy-to-clipboard": "^5.1.1",
@@ -66,7 +66,7 @@
     "glob": "^13.0.6",
     "globals": "^17.6.0",
     "next-validate-link": "^1.6.6",
-    "postcss": "^8.5.14",
+    "postcss": "^8.5.23",
     "raw-loader": "^4.0.2",
     "remark-heading-id": "^1.0.1",
     "semver": "^7.8.0",

apps/login/package.json

@@ -45,7 +45,7 @@
     "lru-cache": "^11.3.6",
     "lucide-react": "^0.577.0",
     "moment": "^2.30.1",
-    "next": "16.2.6",
+    "next": "16.2.11",
     "next-intl": "^4.11.2",
     "next-themes": "^0.4.6",
     "nice-grpc": "^2.1.16",
@@ -61,7 +61,7 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@faker-js/faker": "^9.9.0",
-    "@next/eslint-plugin-next": "16.2.6",
+    "@next/eslint-plugin-next": "16.2.11",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/sdk-trace-node": "^2.7.1",
     "@otplib/core": "^12.0.1",

apps/login/src/helpers/colors.ts

@@ -11,20 +11,7 @@ export interface Color {
 export type MapName = "background" | "primary" | "warn" | "text" | "link";
 
 export type ColorName =
-  | "50"
+  "50" | "100" | "200" | "300" | "400" | "500" | "600" | "700" | "800" | "C900" | "A100" | "A200" | "A400" | "A700";
-  | "100"
-  | "200"
-  | "300"
-  | "400"
-  | "500"
-  | "600"
-  | "700"
-  | "800"
-  | "C900"
-  | "A100"
-  | "A200"
-  | "A400"
-  | "A700";
 
 export type ColorMap = {
   [_key in MapName]: Color[];

apps/login/src/lib/server/idp.ts

@@ -20,8 +20,7 @@ import { createSessionForIdpAndUpdateCookie } from "./cookie";
 import { getPublicHost } from "./host";
 
 export type RedirectToIdpState =
-  | { error?: string | null; samlData?: { url: string; fields: Record<string, string> } }
+  { error?: string | null; samlData?: { url: string; fields: Record<string, string> } } | undefined;
-  | undefined;
 
 export async function redirectToIdp(prevState: RedirectToIdpState, formData: FormData): Promise<RedirectToIdpState> {
   const _headers = await headers();

console/package.json

@@ -14,18 +14,18 @@
   },
   "private": true,
   "dependencies": {
-    "@angular/animations": "^21.2.17",
+    "@angular/animations": "^21.2.19",
     "@angular/cdk": "^21.2.14",
-    "@angular/common": "^21.2.17",
+    "@angular/common": "^21.2.19",
-    "@angular/compiler": "^21.2.17",
+    "@angular/compiler": "^21.2.19",
-    "@angular/core": "^21.2.17",
+    "@angular/core": "^21.2.19",
-    "@angular/forms": "^21.2.17",
+    "@angular/forms": "^21.2.19",
     "@angular/material": "^21.2.14",
     "@angular/material-moment-adapter": "^21.2.14",
-    "@angular/platform-browser": "^21.2.17",
+    "@angular/platform-browser": "^21.2.19",
-    "@angular/platform-browser-dynamic": "^21.2.17",
+    "@angular/platform-browser-dynamic": "^21.2.19",
-    "@angular/router": "^21.2.17",
+    "@angular/router": "^21.2.19",
-    "@angular/service-worker": "^21.2.17",
+    "@angular/service-worker": "^21.2.19",
     "@bufbuild/protobuf": "^2.12.0",
     "@connectrpc/connect": "^2.1.1",
     "@connectrpc/connect-web": "^2.1.1",
@@ -63,10 +63,10 @@
     "@angular-eslint/eslint-plugin": "21.4.0",
     "@angular-eslint/eslint-plugin-template": "21.4.0",
     "@angular-eslint/template-parser": "21.4.0",
-    "@angular/build": "^21.2.17",
+    "@angular/build": "^21.2.19",
-    "@angular/cli": "^21.2.17",
+    "@angular/cli": "^21.2.19",
-    "@angular/compiler-cli": "^21.2.17",
+    "@angular/compiler-cli": "^21.2.19",
-    "@angular/language-service": "^21.2.17",
+    "@angular/language-service": "^21.2.19",
     "@eslint/js": "^10.0.1",
     "@tailwindcss/postcss": "^4.3.0",
     "@types/file-saver": "^2.0.7",

console/src/app/modules/members-table/members-table.component.ts

@@ -17,10 +17,7 @@ import { ProjectMembersDataSource } from '../project-members/project-members-dat
 import { WarnDialogComponent } from '../warn-dialog/warn-dialog.component';
 
 type MemberDatasource =
-  | OrgMembersDataSource
+  OrgMembersDataSource | ProjectMembersDataSource | ProjectGrantMembersDataSource | InstanceMembersDataSource;
-  | ProjectMembersDataSource
-  | ProjectGrantMembersDataSource
-  | InstanceMembersDataSource;
 
 @Component({
   selector: 'cnsl-members-table',

console/src/app/modules/project-members/project-members-datasource.ts

@@ -40,9 +40,7 @@ export class ProjectMembersDataSource extends DataSource<Member.AsObject> {
     this.loadingSubject.next(true);
 
     const promise:
-      | Promise<ListProjectMembersResponse.AsObject>
+      Promise<ListProjectMembersResponse.AsObject> | Promise<ListProjectGrantMembersResponse.AsObject> | undefined =
-      | Promise<ListProjectGrantMembersResponse.AsObject>
-      | undefined =
       projectType === ProjectType.PROJECTTYPE_OWNED
         ? this.service.listProjectMembers(projectId, pageSize, offset)
         : projectType === ProjectType.PROJECTTYPE_GRANTED && grantId

console/src/app/modules/smtp-provider/smtp-provider.component.ts

@@ -299,8 +299,7 @@ export class SMTPProviderComponent {
           ? ({
               case: 'defaults',
               defaults: SMTPKnownProviders[configOrProvider as keyof typeof SMTPKnownProviders] as
-                | (typeof SMTPKnownProviders)[keyof typeof SMTPKnownProviders]
+                (typeof SMTPKnownProviders)[keyof typeof SMTPKnownProviders] | undefined,
-                | undefined,
             } as const)
           : ({ case: 'config', config: this.getConfig(configOrProvider) } as const);
 

console/src/app/pages/users/user-detail/auth-user-detail/auth-user-detail.component.ts

@@ -35,9 +35,7 @@ import { LoginPolicy } from '@zitadel/proto/zitadel/policy_pb';
 import { QueryClient } from '@tanstack/angular-query-experimental';
 
 type MetadataQuery =
-  | { state: 'success'; value: Metadata[] }
+  { state: 'success'; value: Metadata[] } | { state: 'loading'; value: Metadata[] } | { state: 'error'; error: any };
-  | { state: 'loading'; value: Metadata[] }
-  | { state: 'error'; error: any };
 
 type UserWithHumanType = Omit<User, 'type'> & { type: { case: 'human'; value: HumanUser } };
 

console/src/app/pages/users/user-detail/auth-user-detail/edit-dialog/edit-dialog.component.ts

@@ -18,9 +18,7 @@ export type EditDialogData = {
   labelKey: 'ACTIONS.NEWVALUE';
   titleKey: 'USER.LOGINMETHODS.EMAIL.EDITTITLE' | 'USER.PROFILE.CHANGEUSERNAME_TITLE' | 'USER.LOGINMETHODS.PHONE.EDITTITLE';
   descriptionKey:
-    | 'USER.LOGINMETHODS.EMAIL.EDITDESC'
+    'USER.LOGINMETHODS.EMAIL.EDITDESC' | 'USER.PROFILE.CHANGEUSERNAME_DESC' | 'USER.LOGINMETHODS.PHONE.EDITDESC';
-    | 'USER.PROFILE.CHANGEUSERNAME_DESC'
-    | 'USER.LOGINMETHODS.PHONE.EDITDESC';
   isVerifiedTextKey?: 'USER.LOGINMETHODS.EMAIL.ISVERIFIED';
   isVerifiedTextDescKey?: 'USER.LOGINMETHODS.EMAIL.ISVERIFIEDDESC';
   value: string | undefined;

console/src/app/pages/users/user-detail/user-detail/user-detail.component.ts

@@ -71,9 +71,7 @@ type UserQuery =
   | { state: 'notfound' };
 
 type MetadataQuery =
-  | { state: 'success'; value: Metadata[] }
+  { state: 'success'; value: Metadata[] } | { state: 'loading'; value: Metadata[] } | { state: 'error'; value: string };
-  | { state: 'loading'; value: Metadata[] }
-  | { state: 'error'; value: string };
 
 type UserWithHumanType = Omit<UserV2, 'type'> & { type: { case: 'human'; value: HumanUser } };
 

package.json

@@ -9,7 +9,7 @@
   "devDependencies": {
     "@bufbuild/buf": "^1.69.0",
     "@changesets/cli": "^2.31.0",
-    "nx": "21.6.11",
+    "nx": "22.7.7",
     "sass": "^1.99.0",
     "shiki": "^3.23.0",
     "wait-on": "^9.0.10"

pnpm-workspace.yaml

@@ -9,33 +9,11 @@ exclude:
   - benchmark # because of the node 18 or 20 dependency
 
 overrides:
-  "tar@<7.5.16": "^7.5.16 <8.0.0"
+  "axios@<1.18.0": "^1.18.0"
-  "flatted@<3.4.2": "^3.4.2"
+  "brace-expansion@>=4.0.0 <5.0.9": "^5.0.9"
-  "rollup@>=4.0.0 <4.59.0": "^4.59.0"
-  "socket.io-parser@>=4.0.0 <4.2.6": "^4.2.6"
-  "picomatch@>=4.0.0 <4.0.4": "^4.0.4"
-  "lodash@>=4.0.0 <4.18.0": "^4.18.0"
-  "js-yaml@<3.15.0": "^3.15.0"
-  "qs@>=6.11.1 <=6.15.1": "^6.15.2"
-  "ajv@<6.14.0": "^6.14.0"
-  "minimatch@<3.1.4": "^3.1.4"
-  "dompurify@>=3.1.3 <3.4.11": "^3.4.11"
-  "unhead@<2.1.11": "^2.1.11"
-  "brace-expansion@<1.1.13": "^1.1.13"
-  "brace-expansion@>=5.0.0 <5.0.6": "^5.0.6"
-  "yaml@>=2.0.0 <2.8.3": "^2.8.3"
-  "follow-redirects@<1.16.0": "^1.16.0"
-  "axios@<1.17.0": "^1.17.0"
-  "systeminformation@<5.31.6": "^5.31.6"
-  "tmp@<0.2.6": "^0.2.6"
-  "fast-uri@<3.1.2": "^3.1.2"
-  "ws@>=8.0.0 <8.21.0": "^8.21.0"
-  "undici@<6.27.0": "^6.27.0"
-  "webpack@>=5.0.0 <5.104.1": "^5.104.1"
-  "minimatch@>=9.0.0 <9.0.7": "^9.0.7"
   "esbuild@>=0.27.3 <0.28.1": "^0.28.1"
-  "postcss@<8.5.10": "^8.5.10"
+  "postcss@<8.5.23": "^8.5.23"
-  "ip-address@<=10.1.0": "^10.1.1"
+  "sharp@<0.35.0": "^0.35.0"
   "uuid@<11.1.1": "^11.1.1"
-  "@babel/core@<=7.29.0": "^7.29.6"
   "@opentelemetry/core@<2.8.0": "^2.8.0"
+  "@opentelemetry/propagator-jaeger@<2.9.0": "^2.9.0"