fix(build): make prepare tolerant of missing husky + bump deps (Phase 1a)

Two related changes:

1. package.json `prepare` script: changed from "husky" to "husky || true"
   so the script doesn't fail in --prod installs where husky (a
   devDependency) isn't present. The earlier "ENV HUSKY=0" attempt
   didn't help because HUSKY=0 only skips git-hook install once husky
   is invoked — when the husky binary itself is missing, the prepare
   script fails with "sh: husky: not found" before any HUSKY env var
   is consulted. Reverted that ENV from Dockerfile.worker.

2. Phase 1a deps refresh — `pnpm update` within current semver ranges.
   Notably:
   - @pdfme/common, @pdfme/generator, @pdfme/schemas: 5.5.8 → 5.5.10
     (closes XSS in SVG/Select schemas + SSRF in getB64BasePdf +
     decompression-bomb in FlateDecode)
   - postcss: 8.5.8 → 8.5.14 (XSS via </style> in stringify output)
   - mailparser, openai, postgres, react, react-dom, react-hook-form,
     recharts, zustand, jose, libphonenumber-js, prettier, vitest,
     autoprefixer, dotenv: routine minor/patch.

Tests: 1185/1185 vitest passing locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile.worker

@@ -29,11 +29,6 @@ WORKDIR /app
 RUN chown -R worker:nodejs /app
 USER worker
 COPY --chown=worker:nodejs package.json pnpm-lock.yaml ./
-# HUSKY=0 skips the husky install during the `prepare` script — husky is a
-# dev dependency so it's not present in --prod installs, and without this
-# guard pnpm install fails with "sh: husky: not found" (husky 9+ honors
-# the HUSKY=0 env var as the official CI/Docker skip mechanism).
-ENV HUSKY=0
 RUN pnpm install --frozen-lockfile --prod
 COPY --from=builder --chown=worker:nodejs /app/dist/worker.js ./worker.js
 # Healthcheck — pings Redis from inside the worker container. Without

package.json

@@ -24,23 +24,23 @@
     "test:e2e:smoke": "playwright test --project=smoke",
     "test:e2e:exhaustive": "playwright test --project=exhaustive",
     "test:e2e:destructive": "playwright test --project=destructive",
-    "prepare": "husky"
+    "prepare": "husky || true"
   },
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@hookform/resolvers": "^3.9.0",
+    "@hookform/resolvers": "^3.10.0",
-    "@pdfme/common": "^5.5.8",
+    "@pdfme/common": "^5.5.10",
-    "@pdfme/generator": "^5.5.8",
+    "@pdfme/generator": "^5.5.10",
-    "@pdfme/schemas": "^5.5.8",
+    "@pdfme/schemas": "^5.5.10",
     "@radix-ui/react-accordion": "^1.2.12",
     "@radix-ui/react-alert-dialog": "^1.1.15",
     "@radix-ui/react-avatar": "^1.1.11",
     "@radix-ui/react-checkbox": "^1.3.3",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.16",
-    "@radix-ui/react-icons": "^1.3.0",
+    "@radix-ui/react-icons": "^1.3.2",
     "@radix-ui/react-label": "^2.1.8",
     "@radix-ui/react-navigation-menu": "^1.2.14",
     "@radix-ui/react-popover": "^1.1.15",
@@ -55,78 +55,78 @@
     "@radix-ui/react-tabs": "^1.1.13",
     "@radix-ui/react-tooltip": "^1.2.8",
     "@socket.io/redis-adapter": "^8.3.0",
-    "@tanstack/react-query": "^5.62.0",
+    "@tanstack/react-query": "^5.100.9",
-    "@tanstack/react-query-devtools": "^5.62.0",
+    "@tanstack/react-query-devtools": "^5.100.9",
     "@tanstack/react-table": "^8.21.3",
     "@types/pdfkit": "^0.17.6",
     "archiver": "^7.0.1",
-    "better-auth": "^1.2.0",
+    "better-auth": "^1.6.9",
-    "bullmq": "^5.25.0",
+    "bullmq": "^5.76.6",
-    "class-variance-authority": "^0.7.0",
+    "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
-    "drizzle-orm": "^0.38.0",
+    "drizzle-orm": "^0.38.4",
-    "imapflow": "^1.2.13",
+    "imapflow": "^1.3.3",
-    "ioredis": "^5.4.0",
+    "ioredis": "^5.10.1",
     "iso-3166-2": "^1.0.0",
-    "jose": "^6.2.1",
+    "jose": "^6.2.3",
-    "libphonenumber-js": "^1.12.42",
+    "libphonenumber-js": "^1.12.43",
     "lucide-react": "^0.460.0",
-    "mailparser": "^3.9.4",
+    "mailparser": "^3.9.8",
-    "minio": "^8.0.0",
+    "minio": "^8.0.7",
     "next": "15.2.9",
-    "next-themes": "^0.4.0",
+    "next-themes": "^0.4.6",
-    "nodemailer": "^6.9.0",
+    "nodemailer": "^6.10.1",
-    "openai": "^6.27.0",
+    "openai": "^6.37.0",
     "pdf-lib": "^1.17.1",
     "pdfkit": "^0.18.0",
-    "pino": "^9.5.0",
+    "pino": "^9.14.0",
-    "pino-pretty": "^13.0.0",
+    "pino-pretty": "^13.1.3",
-    "postgres": "^3.4.0",
+    "postgres": "^3.4.9",
-    "react": "^19.0.0",
+    "react": "^19.2.6",
     "react-day-picker": "^9.14.0",
-    "react-dom": "^19.0.0",
+    "react-dom": "^19.2.6",
     "react-easy-crop": "^5.5.7",
-    "react-hook-form": "^7.54.0",
+    "react-hook-form": "^7.75.0",
-    "recharts": "^3.8.0",
+    "recharts": "^3.8.1",
     "sharp": "^0.34.5",
-    "socket.io": "^4.8.0",
+    "socket.io": "^4.8.3",
-    "socket.io-client": "^4.8.0",
+    "socket.io-client": "^4.8.3",
-    "sonner": "^1.7.0",
+    "sonner": "^1.7.4",
-    "tailwind-merge": "^2.6.0",
+    "tailwind-merge": "^2.6.1",
     "tailwindcss-animate": "^1.0.7",
     "tesseract.js": "^7.0.0",
     "vaul": "^1.1.2",
-    "zod": "^3.24.0",
+    "zod": "^3.25.76",
-    "zustand": "^5.0.0"
+    "zustand": "^5.0.13"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.5",
-    "@playwright/test": "^1.58.2",
+    "@playwright/test": "^1.59.1",
     "@types/archiver": "^7.0.0",
     "@types/iso-3166-2": "^1.0.4",
     "@types/mailparser": "^3.4.6",
-    "@types/node": "^22.0.0",
+    "@types/node": "^22.19.18",
-    "@types/nodemailer": "^6.4.0",
+    "@types/nodemailer": "^6.4.23",
-    "@types/react": "^19.0.0",
+    "@types/react": "^19.2.14",
-    "@types/react-dom": "^19.0.0",
+    "@types/react-dom": "^19.2.3",
-    "@vitest/coverage-v8": "^4.1.0",
+    "@vitest/coverage-v8": "^4.1.5",
-    "autoprefixer": "^10.4.27",
+    "autoprefixer": "^10.5.0",
-    "dotenv": "^17.3.1",
+    "dotenv": "^17.4.2",
-    "drizzle-kit": "^0.30.0",
+    "drizzle-kit": "^0.30.6",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.25.12",
-    "eslint": "^9.0.0",
+    "eslint": "^9.39.4",
     "eslint-config-next": "15.2.9",
-    "eslint-config-prettier": "^9.1.0",
+    "eslint-config-prettier": "^9.1.2",
-    "husky": "^9.1.0",
+    "husky": "^9.1.7",
-    "lint-staged": "^15.2.0",
+    "lint-staged": "^15.5.2",
-    "postcss": "^8.4.0",
+    "postcss": "^8.5.14",
-    "prettier": "^3.4.0",
+    "prettier": "^3.8.3",
-    "react-grab": "^0.1.32",
+    "react-grab": "^0.1.33",
-    "tailwindcss": "^3.4.0",
+    "tailwindcss": "^3.4.19",
-    "tsx": "^4.19.0",
+    "tsx": "^4.21.0",
-    "typescript": "^5.7.0",
+    "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "vitest": "^4.1.5"
   }
 }