[patrickbrandao]

Supersedes Dependabot #147 (and #118). Same manifest bumps as #147, on our own branch so Dependabot can't wipe the fix commits.

Changes

• All patch/minor bumps from chore(deps): Bump the patch-and-minor group across 1 directory with 30 updates #147 (NestJS 11.2.7, Vite 6.4.4, pg, zod, modelparams ^0.0.72, eslint, prettier, lint-staged, ...). chore(deps): Bump the patch-and-minor group across 1 directory with 30 updates #147 also carried a stale check:api-prefix script line from its old base. I left it out because main no longer has the script.
• package-lock.json regenerated with npm 11.19.0 (npm install --package-lock-only). The "peer": true count is 1, the same as main. Dependabot's npm 10 lockfile breaks npm ci.
• @typescript-eslint/parser aligned with the plugin range (^8.71.1).
• Cherry-picks ba6856d: the backend reads the modelparams catalog in the 0.0.71+ data.js layout. Without this, the backend crashes at boot.
• Extracts and exports extractModelparamsCatalogLiteral(source), with unit tests for the old layout, the new layout, an unknown layout (throws) and strings containing ] and ;.
• Patch changeset.

Closes #143

Local tests (Node 24 / npm 11.19)

• npm ci: ok
• backend lint/typecheck/build: ok. Unit tests: 9088 passed.
• frontend lint/typecheck/build: ok. Tests: 4175 passed.
• cli typecheck/build: ok. Tests: 307 passed. shared typecheck/build: ok. Tests: 525 passed.
• npm run test:e2e:docker -w packages/backend: 591/599. The 8 failures were all in request-recordings.e2e-spec.ts, a beforeAll 30s timeout while the host was under load. Rerunning that suite alone: 8/8 passed.

qa-docker is needed before this leaves draft.

🤖 Generated with Claude Code

[patrickbrandao]

Review: #159 chore(deps): bump the patch-and-minor group (supersedes #147)

Diff reviewed: git diff origin/main...aba11bcdce066ca8d4b4257d903e9381ae98cfe5

Blockers: none.

Should-fix: none.

Nits: none.

Checks

• Modelparams parse fix (packages/backend/src/routing/routing-core/provider-param-spec.service.ts:174-181): the new regex accepts both the old layout (export const CATALOG = [...];\nfunction authSuffix) and the 0.0.71+ layout (const GENERATED_CATALOG = [...];\nexport const CATALOG = GENERATED_CATALOG). I unpacked the published modelparams@0.0.72 tarball. Its dist/generated/data.js uses the 0.0.71+ layout: line 3 opens the array and line 38159 is export const CATALOG = GENERATED_CATALOG;, so the regex matches it. The lazy match stops only at ];\n followed by one of the two anchors, so a ] or ; inside a string doesn't cut the literal short, and the tests cover that case. A layout it doesn't recognize still throws a clear error.
• Tests: four new unit cases (old layout, new layout, a string containing ];, unknown layout).
• Lockfile: no new "peer": true markers. Every resolved URL is on registry.npmjs.org. The only new package is lint-staged/node_modules/tinyexec. @better-auth/* doesn't change. There are no new runtime outbound destinations.
• One major bump: @types/supertest goes from 6 to 7. It's types only, and typecheck and e2e pass.
• The changeset is present. The title follows Conventional Commits.
• CI on aba11bc: all 19 check runs are success, including both e2e runs, both Docker builds and the compose smoke test.
• High risk: no criterion applies. Auth and crypto packages are unchanged, and there are no workflow or governance files.

Gate outside this verdict: the PR is still a draft, and its body says qa-docker is still needed. The modelparams change touches runtime, so qa-docker must pass on this SHA before merge.

Merge order with #146: merge this PR first. #146 touches the same vitest and @vitest/coverage-v8 lines in packages/frontend/package.json and overlaps in package-lock.json. After this PR lands, #146 must merge main and regenerate its lockfile with npm 11, then get new CI and a new review.

Head revisado: aba11bc
Veredito: aprovado

[patrickbrandao]

qa-docker report for PR #159 (run thinker-qa-7433d8)

Step	Result	Time
Head SHA confirmed	pass	-
Docker build thinker:qa-7433d8 (arm64, 427 MB)	pass	1m30s
Stack up (read-only compose, volumes isolated by override), health 200	pass	~6s to healthy
Backend boot: no JSON/parse/SyntaxError in logs	pass	-
GET /api/v1/routing/qa-agent/model-param-specs/index	pass (200)	-
Dashboard HTML, first-admin setup, sign-in, agent + thk_ key	pass	-
/v1/models	pass (200)	-
/v1/chat/completions via mock	pass	-
/v1/messages via mock	pass	-
/v1/responses via mock	pass	-
Gateway contracts (9 tests, with agent key)	pass 9/9	1.4s
Backend e2e test:e2e:docker	pass, 71 suites / 599 tests	8m03s
Teardown (volumes labeled, down -v, none left)	pass	-

Notes:

• Base images: node:24-alpine, node:24-slim, gcr.io/distroless/nodejs24-debian13:nonroot. Postgres 16.15 (postgres:16-alpine).
• THINKER_CATALOG_SYNC=false, random 64-hex THINKER_ENCRYPTION_KEY, mock provider only. Ports 5432/5433 untouched.
• Fresh-DB boot logs a single [Better Auth] Database schema mismatch / Missing tables ERROR before migrations run; the app then migrates and works. Not specific to this PR as far as I can tell (not compared against main).
• Nothing flaky.

Tested SHA: aba11bc