chore: bump deps and migrate .inputValidator → .validator

- Update `@types/node`, `semver`, TanStack Router/Start, `posthog-node`, `shadcn`, `fumadocs-mdx`, and a handful of other minor dep bumps across the monorepo
- Upgrade pnpm to 11.5.2
- Replace deprecated `.inputValidator(…)` calls with `.validator(…)` on all server functions

apps/cli/package.json

@@ -52,18 +52,18 @@
     "handlebars": "^4.7.9",
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
-    "semver": "^7.8.1",
+    "semver": "^7.8.3",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "catalog:",
     "@types/semver": "^7.7.1",
     "@withstanza/codemods": "workspace:*",
     "@withstanza/registry": "workspace:*",
     "@withstanza/schema": "workspace:*",
     "@withstanza/utils": "workspace:*",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
     "vite-plus": "catalog:",
     "vitest": "catalog:"
   }

apps/web/package.json

@@ -18,13 +18,13 @@
     "@pierre/trees": "1.0.0-beta.4",
     "@tabler/icons-react": "^3.44.0",
     "@tailwindcss/vite": "^4.3.0",
-    "@takumi-rs/image-response": "^1.6.0",
+    "@takumi-rs/image-response": "^1.7.0",
     "@tanstack/react-devtools": "^0.10.5",
     "@tanstack/react-hotkeys": "^0.10.0",
     "@tanstack/react-pacer": "^0.22.1",
-    "@tanstack/react-router": "^1.170.11",
+    "@tanstack/react-router": "^1.170.15",
     "@tanstack/react-router-devtools": "^1.167.0",
-    "@tanstack/react-start": "^1.168.19",
+    "@tanstack/react-start": "^1.168.25",
     "@vercel/analytics": "^2.0.1",
     "@vercel/functions": "^3.6.2",
     "@withstanza/registry": "workspace:*",
@@ -32,17 +32,17 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "fumadocs-core": "^16.9.3",
-    "fumadocs-mdx": "^15.0.10",
+    "fumadocs-mdx": "^15.0.11",
     "fumadocs-ui": "npm:@fumadocs/base-ui@^16.9.3",
     "lru-cache": "^11.5.1",
     "motion": "^12.40.0",
     "nitro": "3.0.260603-beta",
-    "posthog-node": "^5.35.13",
+    "posthog-node": "^5.36.4",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-resizable-panels": "^4.11.2",
     "recharts": "^3.8.1",
-    "shadcn": "^4.10.0",
+    "shadcn": "^4.11.0",
     "shiki": "^4.2.0",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.6.0",
@@ -51,18 +51,18 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tailwindcss/typography": "^0.5.19",
+    "@tailwindcss/typography": "^0.5.20",
     "@tanstack/devtools-vite": "^0.7.0",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
-    "@types/mdx": "^2.0.13",
+    "@types/mdx": "^2.0.14",
-    "@types/node": "^25.9.1",
+    "@types/node": "catalog:",
-    "@types/react": "^19.2.16",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
     "@vitejs/plugin-rsc": "^0.5.27",
     "jsdom": "^29.1.1",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
     "vite": "catalog:",
     "vite-plus": "catalog:",
     "vitest": "catalog:"

apps/web/src/lib/selection.ts

@@ -29,7 +29,7 @@ const SEARCH_KEYS = ["name", "pm", ...KNOWN_CATEGORIES] as const;
 
 /**
  * Shared by the route's `validateSearch` and the server function's
- * `inputValidator` so direct HTTP calls can't bypass the allow-list.
+ * `validator` so direct HTTP calls can't bypass the allow-list.
  */
 // Cap to keep a hostile URL from cramming thousands of comma-joined ids into
 // any single search param. Well above any legitimate selection.

apps/web/src/routes/docs.$.tsx

@@ -19,7 +19,7 @@ import { getDocMeta } from "@/server/docs-meta.functions";
 // they flow through React Flight natively. Client components in the tree ship
 // as `'use client'` references and hydrate normally.
 const getDocLayout = createServerFn({ method: "GET" })
-  .inputValidator((slugs: string[]) => slugs)
+  .validator((slugs: string[]) => slugs)
   .handler(async ({ data: slugs }) => {
     const page = source.getPage(slugs);
     if (!page) throw notFound();

apps/web/src/server/builder-state.functions.ts

@@ -37,7 +37,7 @@ export type BuilderState = {
 export const getBuilderState = createServerFn({ method: "GET" })
   // Server functions are HTTP-reachable; share the route's allow-list so a
   // direct POST can't bypass it.
-  .inputValidator(validateBuilderSearch)
+  .validator(validateBuilderSearch)
   .handler(async ({ data }): Promise<BuilderState> => {
     // Warm the Shiki singleton during the initial empty-state load (which
     // renders zero previews and so would otherwise never touch the

apps/web/src/server/docs-meta.functions.ts

@@ -6,7 +6,7 @@ import { source } from "@/lib/source";
 // Serializable docs page metadata for `head()`. Kept out of `docs.$.tsx` so
 // it isn't pulled into the RSC bundle by that file's `react-start/rsc` import.
 export const getDocMeta = createServerFn({ method: "GET" })
-  .inputValidator((slugs: string[]) => slugs)
+  .validator((slugs: string[]) => slugs)
   .handler(async ({ data: slugs }) => {
     const page = source.getPage(slugs);
     if (!page) throw notFound();

apps/web/src/server/module-detail.functions.ts

@@ -65,7 +65,7 @@ export type ModuleDetail = {
 };
 
 export const getModuleDetail = createServerFn({ method: "GET" })
-  .inputValidator((data: ModuleDetailInput) => {
+  .validator((data: ModuleDetailInput) => {
     // category + id are used to look the entry up in the index; constrain them
     // to the known shape anyway (the module file is then loaded via the entry's
     // own `path`, which the index schema already guards against traversal).

package.json

@@ -24,14 +24,14 @@
   "devDependencies": {
     "@changesets/changelog-github": "^0.7.0",
     "@changesets/cli": "^2.31.0",
-    "@types/node": "^25.9.1",
+    "@types/node": "catalog:",
     "@vercel/blob": "^2.4.0",
     "@withstanza/schema": "workspace:*",
     "jiti": "^2.7.0",
     "svgo": "^4.0.1",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
     "vite-plus": "catalog:",
     "vitest": "catalog:"
   },
-  "packageManager": "pnpm@11.5.1"
+  "packageManager": "pnpm@11.5.2"
 }

packages/codemods/package.json

@@ -17,8 +17,8 @@
     "ts-morph": "^28.0.0"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "catalog:",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
     "vite-plus": "catalog:",
     "vitest": "catalog:"
   }

packages/create-stanza/package.json

@@ -35,8 +35,8 @@
     "stanza-cli": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "catalog:",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
     "vite-plus": "catalog:"
   }
 }

packages/registry/package.json

@@ -18,7 +18,7 @@
   },
   "devDependencies": {
     "@types/validate-npm-package-name": "^4.0.2",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
     "vite-plus": "catalog:",
     "vitest": "catalog:"
   }

packages/schema/package.json

@@ -43,9 +43,9 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "catalog:",
     "@withstanza/utils": "workspace:*",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
     "vite-plus": "catalog:",
     "vitest": "catalog:"
   }

packages/utils/package.json

@@ -10,8 +10,8 @@
     ".": "./src/index.ts"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "catalog:",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
     "vite-plus": "catalog:",
     "vitest": "catalog:"
   }

pnpm-workspace.yaml

@@ -3,6 +3,8 @@ packages:
   - packages/*
   - registry/modules/*
 catalog:
+  "@types/node": ^25.9.2
+  typescript: ^6.0.3
   vite: npm:@voidzero-dev/vite-plus-core@^0.1.24
   vite-plus: ^0.1.24
   vitest: npm:@voidzero-dev/vite-plus-test@^0.1.24

registry/modules/auth-clerk/package.json

@@ -9,6 +9,6 @@
     "@withstanza/schema": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1"
+    "@types/node": "^25.9.2"
   }
 }