Dependabot: 9 bumps deferred pending migration (sweep 2026-06-23)

Dependabot sweep on 2026-06-23. 6 safe bumps were adopted (#339 docker/login-action, #340 ssh-agent, #341 pnpm/action-setup, #323 setup-node, #327 upload-artifact, #333 @types/supertest). The 9 below each fail CI against current main (real breaking changes, not staleness) or need ecosystem-specific verification — each is a real migration, deferred here with the diagnosis + fix hint so it can be picked up cleanly. PRs left open so Dependabot keeps them current.

Progress — 2026-06-23: @noble/hashes 1→2 migrated and merged (#345) — 8 deferred remain.

Needs code migration (CI verified-failing on current main)

• #335 @noble/hashes 1.8.0→2.2.0 — ✅ DONE via #345. Bigger than triaged: v2 dropped all bare subpath exports (not just sha256/sha512→sha2), so every import moved to the .js-suffixed sha2.js/sha3.js/utils.js paths — 22 sites across root API + @sipher/sdk + @sipher/agent. Merged with NIST/Keccak known-answer characterization tests proving byte-identical output on both v1 and v2. Confirmed all three packages resolve @noble/hashes@2.2.0; the @sip-protocol/sdk transitive 1.x coexists harmlessly. Superseded Dependabot #335.
• #332 zod 3→4 — error.errors → error.issues (src/middleware/validation.ts:29) + general zod 4 migration (defaults, error formats). Verify all schema validation paths.
• #331 vitest 3→4 — test runtime error; vitest 4 config/API migration.
• #336 @vitejs/plugin-react 4→6 — app build/e2e fails (dist/app.js not produced); Vite plugin major.
• #330 pino-http 10→11 — No overload matches this call (src/logger.ts:26); logger options API change.
• #342 minor/patch group (25 updates) — one update bumped a TypeBox-related dep that changed TSchema; tests/pi/tool-adapter.test.ts accesses .type/.properties/.required on it → typecheck fails. Adapt the test's TSchema access, or have Dependabot re-group excluding the breaking update to land the other 24.

Needs ecosystem-specific verification (not covered by PR CI)

• #334 jsdom 25→29 — dev dep, only a pnpm-lock.yaml conflict (no code change). Re-resolve the lockfile + merge.
• #328 node 22→26-alpine — Docker base image. The Docker build runs only on the main deploy, not on PRs, so green PR CI does NOT verify it. Run docker build locally before merging.
• #322 reqwest 0.12→0.13 (/sdks/rust) — Rust HTTP lib. Verify cargo build / cargo test in the Rust SDK.

Treat this as a migration tracker and select one unchecked entry rather than tackling the whole sweep. Start with the named locations: src/middleware/validation.ts, src/logger.ts, tests/pi/tool-adapter.test.ts, or /sdks/rust; run the relevant CI checks, cargo build/test, or docker build as indicated. Done means the selected dependency update passes its verification and the remaining entries stay independently actionable.