chore: weekly maintenance — dep bumps

[arzafran]

Weekly automated dependency sweep.

What was bumped

• tsdown ^0.21.4 → ^0.22.8 (dev dependency, root package)

That's the only change: bun.lock is gitignored in this repo, so every install already resolves to the newest version allowed by each declared semver range — there was nothing else left to bump within-range. All other outdated packages require a range change and are one or more majors behind (see below).

Verified

• bun install — clean, no errors
• bun run build (tsdown) — succeeds, output unchanged in size/shape, both before and after the bump

No lint, typecheck, or test scripts exist in this repo (root package.json only defines build, dev, and version/publish scripts), so those steps were skipped.

Findings (not acted on)

Majors available (require a human decision, not bumped):

package	current	latest	workspace
@biomejs/biome	1.9.4	2.5.4	root
typescript	5.9.3	7.0.2	root, playground
react / react-dom (peer)	18.3.1	19.2.7	root
astro	4.16.19	7.0.9	playground
@astrojs/react	3.6.3	6.0.1	playground
@types/react / @types/react-dom	18.3.x	19.x	playground
lorem-ipsum	2.0.10	3.0.0	playground

CI observations (.github/workflows/publish.yml):

• actions/checkout@v4 — 3 majors behind (latest v7, released June 2026; v7 also changes default behavior around fork PR checkouts for pull_request_target/workflow_run triggers, not relevant to this workflow's release trigger but worth knowing).
• actions/setup-node@v4 — 2 majors behind (latest v6).
• oven-sh/setup-bun@v2 — up to date (latest is v2.2.x).

Security: GitHub reported 13 Dependabot alerts on main after this push (3 high, 7 moderate, 3 low) — not something this sweep can see into or fix; worth a look at https://github.com/darkroomengineering/hamo/security/dependabot.

Repo hygiene: bun.lock is in .gitignore, so dependency resolution isn't reproducible/pinned across installs — every bun install re-resolves to the newest version satisfying each range. Intentional for a published library, but flagging in case that wasn't a deliberate choice.

Not merging — left for review.

---

Generated by Claude Code