Upgrade Deps

Single goal: move dependencies forward in small, verified, reversible groups, so every commit is green and every break has one suspect.

Do not mix refactors, feature work, or lint-rule cleanups into upgrade commits. Fix only what the upgrade itself breaks.

Core Rules

Start from a clean git tree and a recorded baseline. A failure that existed before the upgrade is not an upgrade failure.
Never guess a breaking change. Read the official changelog, release notes, or migration guide for every major (and every minor of a 0.x package) before editing code.
One major per group. Patch and minor updates batch together. Coupled families move together.
Security fixes go first, as their own group.
Run non-interactive commands only. Never use bun update -i or any prompt-driven flow; select packages by name or pattern.
Respect the supply-chain gate: prefer versions that are at least a few days old, and review new maintainers and install scripts before trusting a package. See supply-chain.md.
Keep the lockfile committed with its package.json change. Never hand-edit bun.lock.
If a group breaks and the cause is not clear in one pass, stop, bisect the group, and defer the culprit. Do not push through red gates.
Preserve unrelated user changes. Do not touch packages the user excluded or pinned on purpose without saying why.