chore(deps): action v7 majors, remaining held-back majors, and a postcss override

[kelsos]

The wrap-up PR for the renovate dashboard (#169): the v7 action majors, the remaining held-back majors, ui-library with its brand-icon migration, and a postcss override that finally closes the two advisories.

Six commits, one per logical group, so any single one can be dropped without unpicking the rest.

1. chore(ci) — action v7 majors

checkout v6.1.0→v7.0.1, setup-node v6.5.0→v7.0.0, setup-go v6.5.0→v7.0.0, cache v5.1.0→v6.1.0, codecov v6.0.2→v7.0.0.

codecov is a relabel, not new code: v6, v6.0.2, v7 and v7.0.0 all point at fb8b3582, the SHA we were already pinned to. Only the comment moves, so renovate stops offering it.

Each new SHA was checked back against its tag, and every with: input still exists and is undeprecated in the v7 definitions. actionlint clean.

2. chore(deps) — postcss override + leftovers

This is the one that actually fixes something. The catalog has been on a patched postcss since #645, but a second vulnerable 8.5.15 stayed in the lockfile, because stylelint-order@8.1.1 (still newest) declares postcss: ^8.5.8 and pnpm will not re-resolve an already-satisfied range. Dependabot reads the lockfile, so GHSA-r28c-9q8g-f849 and GHSA-fxqj-rqcc-2cmp stayed open even though nothing we ship used the old copy.

An overrides entry forces a single copy. With that in place the catalog also moves to 8.5.24 at no duplication cost. Generated CSS is byte-identical — the entry stylesheet hashes to the same entry.BMCHlK-8.css as before.

Also: @unhead/vue 2.1.16 (staying on v2, since vite-ssg pins it) and go-redis 9.22.0.

3. feat(ui) — brand icons + ui-library 2.23.2

lucide v1 removed every brand glyph on purpose, and ui-library followed. Any logo the app renders must be registered by the app or it renders blank, so registration and the bump land in the same commit — bumping first would leave them blank in between.

Audited what the site actually renders rather than trusting the plan; it is exactly seven:

• socials (4): lu-github, lu-x-twitter, lu-discord, lu-reddit — FooterIconLinks.vue, ValueContact.vue
• payment: lu-paypal — PaymentMethodSelection.vue
• platform: lu-os-apple, lu-os-windows — download.vue, UserDevicesTable.vue

lu-x is also used but needs nothing: that's lucide's generic close glyph, not the X brand mark. Crypto network marks stay in the library. packages/card-payment renders no brand logos, so it needs no registration.

The library's lu-paypal and lu-os-windows hard-coded stroke: black and did not adapt to dark mode; these use currentColor so they theme correctly. Icon data sits next to the plugin that consumes it, so the runtime file doesn't depend on an app alias.

4-6. The remaining majors

• pinia 3.0.4 → 4.0.2 + @pinia/nuxt 0.11.3 → 1.0.1. No code changes; the stores already use the setup syntax pinia 4 keeps.
• swiper 12.1.4 → 14.0.6, skipping 13. Supersedes the pending 12.2.0 minor. Every entry point the carousels import still exists, and the prerendered homepage still emits swiper markup.
• bumpp 11.1.0 → 12.0.0. Only backs the release script.
• satori 0.26.0 → 0.29.0. Renders every OG image, so instead of eyeballing it: snapshotted the 157 images built on 0.26.0, rebuilt from a clean .output on 0.29.0, compared sha256 across the set. All 157 byte-for-byte identical, and confirmed via mtimes they were genuinely re-rendered, not reused.
• braintree-web 3.142.0 → 3.144.0. Consumed by both website and card-payment.

better-sqlite3 13 was attempted and dropped

It failed build-docker with "Could not find any Python installation to use". Not a missing binary: 13.0.1 does bundle prebuilds via prebuildify, linuxmusl-x64.node included, but its package.json still declares an unconditional install: node-gyp rebuild with gypfile: true, so package managers compile from source and never look at the bundled binary — WiseLibs/better-sqlite3#1503.

13.0.2 drops that install script and fixes it, but it's 6 days old (inside minimumReleaseAge) and carries an open regression where the bundled linux-arm64 prebuild needs GLIBC_2.38 — #1509. Staying on 12.11.1, which is the newest 12.x installable: v12.11.2 exists as a github release but was pulled from npm (#1493).

Deliberately not here

• typescript 7 — hard blocked, vue-tsc has no stable programmatic API until TS 7.1.
• @unhead/vue 3 — blocked by vite-ssg@28.3.0 depending on @unhead/vue: ^2.1.2 as a direct dep. See the discussion on chore(deps): update nuxt to 4.5.1 and vite to 8 #649.
• @rotki/eslint-config 7 — wants its own PR, most likely to churn the tree.
• better-sqlite3 13 — see above.
• Anything inside the 7 day minimumReleaseAge window, including @vueuse/* 14.4.0 (eligible tomorrow), vite 8.2.0, and bumpp 12.1.1.

Verification

Run after every commit, and again on the final stack: typecheck clean, lint clean (68 pre-existing warnings, 0 errors), 502 tests pass, generate builds 181 pages + 155 OG images, packages/card-payment builds, Go builds/vets with all 20 test packages passing, and pnpm install --frozen-lockfile is consistent.

The docker image was also built locally on the final stack, since build-docker is what caught the better-sqlite3 problem.

Worth an eyeball during the smoke pass, since green CI can't cover these: the homepage carousel (swiper 14), the footer / contact / checkout / download pages for the brand logos, and the card payment flow (braintree-web) — hosted fields rendering, a successful sale, and a declined card surfacing actionable copy.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.92%. Comparing base (7cdec8e) to head (67c1d81).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #650   +/-   ##
=======================================
  Coverage   27.92%   27.92%           
=======================================
  Files         391      391           
  Lines       12457    12457           
  Branches     1945     1945           
=======================================
  Hits         3478     3478           
  Misses       8880     8880           
  Partials       99       99           

Flag	Coverage Δ
backend	56.55% <ø> (ø)
frontend	18.72% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.