chore(deps): consolidate dependabot bumps with flake hash update

[clay-good]

Status: Ready for review once the Nix hash commit lands (see note below).

What was missing: Dependabot PRs #1418, #1421, and #1423 each fail CI because flake.nix pins the pnpm dependency hash, which breaks on any lockfile change — and Dependabot can't update it. Fixing each branch separately means recomputing the hash after every merge.

What it does: Applies all three sets of bumps in one PR with a single flake hash update:

Dependency	From	To	Dependabot PR
chalk	5.5.0	5.6.2	#1418
posthog-node	5.20.0	5.46.0	#1418
zod	4.0.17	4.4.3	#1418
@changesets/changelog-github	0.5.2	0.7.0	#1421
@changesets/cli	2.29.6	2.31.1	#1421
typescript-eslint	8.62.0	8.65.0	#1421
eslint	9.39.2	10.7.0	#1423

Resolved versions meet or exceed every Dependabot target, so Dependabot will close #1418/#1421/#1423 automatically once this merges.

Proof it works: pnpm build clean; pnpm lint passes with eslint 10 (0 errors); full suite vitest run against dist: 2196/2196 tests pass in 111 files, including the template parity-hash tests. Lockfile regenerated with pnpm@9.15.9 (matches packageManager), lockfileVersion 9.0 preserved.

Notes: The flake.nix pnpmDeps hash is updated in a follow-up commit on this branch using the hash CI reports (no local nix). eslint 10 surfaced one warning (unused disable directive) — left as-is, non-blocking.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated development tooling and runtime libraries to newer versions, including linting, TypeScript-related packages, changelog tooling, analytics, terminal styling, and validation.
  • Refreshed the dependency fetch checksum to ensure consistent package retrieval.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2278ce03-9e9f-4beb-927d-36f3fbdb7180

📥 Commits

Reviewing files that changed from the base of the PR and between 996965c and e395e39.

📒 Files selected for processing (1)

• flake.nix

---

📝 Walkthrough

Walkthrough

Updated selected development tooling and runtime dependency versions in package.json, along with the pinned pnpmDeps hash in flake.nix.

Changes

Dependency Version Updates

Layer / File(s)	Summary
Package dependency versions and pnpm hash package.json, flake.nix	Bumps selected development and runtime dependencies and refreshes the fetchPnpmDeps hash.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• Fission-AI/OpenSpec#1249: Updates overlapping dependency versions and the pinned flake.nix pnpm dependency hash.

Suggested reviewers: tabishb

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the combined dependency bumps and flake hash update in the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/consolidated-dependabot-bumps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[alfred-openspec]

Approved at exact head e395e39. The frozen install resolves the intended seven dependency bumps, both production and full audits report zero vulnerabilities, build/lint/Changesets status and the full 2,196-test suite pass, the worktree remains clean, and the exact-head Linux/macOS/Windows/Nix/security/CodeQL matrix is green.