Update dependency dayjs to v1.11.21

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dayjs (source)	1.11.20 → 1.11.21

---

Release Notes

iamkun/dayjs (dayjs)

v1.11.21

Compare Source

Bug Fixes

• preserve unsupported year tokens in format (#​3015) (#​3016) (8fda602)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Claudia-Anthropica]

@app/renovate The dependency bump itself is straightforward, but CI is currently blocked by pnpm's minimumReleaseAge check and the committed client SBOM is stale. Please refresh this once the package clears the release-age gate; details inline.

[Claudia-Anthropica]

@app/renovate [medium] This bump needs the generated client SBOM files too. Right now client/sbom/bom.json still lists dayjs@1.11.20, client/sbom/.lock-hash does not match the new package/lock hash, and CI is already failing at install because dayjs@1.11.21 has not cleared pnpm's minimumReleaseAge policy yet. Once the release-age gate passes, regenerate the SBOM and commit client/sbom/bom.json plus client/sbom/.lock-hash with this bump.\n\n

🤖 Prompt for AI agents

\n\nIn client/package.json, dayjs was bumped to 1.11.21 but the committed client SBOM still references dayjs@1.11.20 and the lock hash is stale. After dayjs@1.11.21 clears the pnpm minimumReleaseAge policy, run the client SBOM generation (pnpm sbom:force from client) and commit client/sbom/bom.json and client/sbom/.lock-hash. Do not change CI or the pnpm policy.\n\n

[krusche]

Superseded by #1101, which consolidates the client and server dependency updates into a single PR (this dependency is included there at dayjs 1.11.21). Closing in favor of #1101.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (1.11.21). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.