- yarn.lock refreshed within existing ranges for the open advisories.
- copy-webpack-plugin 11 -> 14 (serialize-javascript 7) and
terser-webpack-plugin 5.6: build:www output is identical except four
chunks where terser now emits `a ?? b` for `null == a ? b : a`.
- testcontainers (page-addresses, test-support) and devtron were never
imported: removed (undici, @fastify/busboy, highlight.js went with
them).
- The crypto-browserify webpack fallback was dead: build:www is
byte-identical without it, so the fallback and the dependency are gone
and a future `crypto` import fails the build instead of shipping a
polyfill.
- braces resolves to @pezkuwi/braces 3.0.4, which limits nesting depth
(CVE-2026-93687; no upstream release).
- dev ^0.86.4 at the root and in packages/apps; directives renamed by
pezkuwi-dev-migrate-eslint10.
- eslint --fix with the 0.86.4 config; one fix broke syntax
(typescript-eslint prefer-optional-chain turned
`(isStarted && onStart) && onStart()` into `(isStarted && onStart?.();`
in TxButton) and is corrected by hand.
- The remaining findings fixed rather than disabled: optional chains
(each suggestion reviewed), `cause` on rethrown errors, `if` instead of
`a && promise` in effects, parallel instead of sequential awaits in
Promise.all, Error rejections, no `delete` on arrays (the storage query
cache is a Map; an upload's file list no longer keeps a hole), no
`[object Object]` stringification (TFunction's second argument is text
or options), dead code removed (referenda's never-shown expand button,
react-query's unused CoreDescriptor).
Satoshi Qazi Muhammed