chore(deps): integrate security and Effect v4 RC upgrades

[kattsushi]

Closes #152

Type

• New feature
• Bug fix
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Summary

• Eliminates all critical dependency audit findings and reduces high, moderate, and low findings.
• Upgrades Hatchet, Prisma, Astro/Starlight, Nx, and the Effect v4 ecosystem.
• Adds the official Nx dual TypeScript setup: TS6 for programmatic tooling APIs and patched TypeScript 7 for compilation.

Changes

Area	Change
Web/auth	Better Auth 1.7.1, Remix 2.17.5, React Router 8.3.0, and critical transitive fixes
Hatchet	SDK 1.28.2 with compatible wrapper/runtime validation
Prisma	Prisma family 7.9.1 and regenerated clients
Documentation	Astro 7.2.4, Starlight 0.41.7, and compatible docs integrations
Tooling	Nx 23.1.1 and regenerated cumulative lockfile
Effect	Effect family 4.0.0-rc.111, language service 0.87.2, and Effect tsgo 0.36.5
TypeScript	Official TS6 API / TypeScript 7.0.2 compiler aliases for Nx compatibility
Packages	Preserve Effect 3/4 peer compatibility for React and Solid query packages

Verification

• Frozen pnpm install passed.
• Nx graph loaded all projects.
• Workspace typechecks passed: 26 projects plus 2 no-build targets.
• Workspace tests passed: 13 projects.
• Workspace builds passed: 23 projects.
• Workspace lint passed: 28 projects, zero errors.
• Formatting and git diff --check passed.
• Prisma 7.9.1 generation passed.
• Astro produced 53 documentation pages.
• React and Solid query package dry runs retained Effect peer dependencies.
• Audit improved from 5 critical / 99 high / 91 moderate / 16 low to 0 critical / 56 high / 57 moderate / 8 low.

Size Exception

size:exception was explicitly approved for this integrated PR. The six work units were reviewed individually in tuicr, then applied in order and revalidated as one dependency graph. A single final PR keeps the cumulative lockfile, Effect RC migration, and TypeScript dual-alias architecture consistent.

Out of Scope

• Unsupported overrides for remaining upstream Nx, Remix, Hatchet, Prisma, Astro, Verdaccio, and Cypress advisories.
• Publishing package releases.
• Merging this PR without CI and maintainer review.

Contributor Checklist

• Linked approved issue chore(deps): integrate security and Effect v4 RC upgrades #152.
• Added exactly one type:* label.
• No shell scripts were modified; shellcheck is not applicable.
• Focused and workspace-wide validation passed.
• Documentation build verified where behavior changed.
• Conventional commits with no Co-Authored-By trailers.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d1024369-07f2-49c1-831e-b30de7265138

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}