chore(deps): update dependencies and bump PR validation to Node 22

[Yohan Lasorsa (sinedied)]

Summary

Refreshes package-lock.json within the existing semver ranges, and bumps the PR validation workflow from Node 18 to Node 22.

Note

This does not fix the failing Release CLI workflow. That failure is unrelated to dependencies — see below.

The npm update husky failure

npm update fails with:

npm error path node_modules/@rimac-technology/semantic-release-monorepo
npm error command sh -c husky
npm error sh: 1: husky: not found

This is an upstream packaging bug affecting every published version (1.1.6 → 1.2.10), not a regression from updating:

Source	postinstall
Registry metadata (npm view … scripts)	husky
Tarball package.json	_postinstall (pinst-disabled)

The package uses pinst to strip its husky hook at pack time, but npm records packument metadata before prepack runs. So the registry advertises a postinstall hook the tarball doesn't actually contain, and husky isn't a runtime dependency of the package.

• Fresh npm i / npm update resolve from registry metadata → run husky → fail
• npm ci resolves from the lockfile and reads the on-disk _postinstall → no-op → CI is unaffected

Workaround used here: npm update --ignore-scripts.

Node 18 → 22 in pull-request.yml

PR validation was two LTS majors behind the other workflows (deploy.yml is on 22, release-cli.yml on 24). Since #190, the CLI depends on @github/copilot-sdk, which declares engines.node >= 20 — so PR builds were validating against an engine the dependency no longer supports. Set to 22 to match deploy.yml.

Verification

Full PR CI sequence run locally against the new lockfile on Node 22.23.2 / npm 10.9.8 (matching the updated workflow):

Step	Result
npm ci	exit 0
npm run create:db	88 workshops
npm run build:website	OK
npm run build:cli	OK
npm test --if-present --workspaces	OK (2 pre-existing TODO warnings)

Also verified on Node 24 / npm 11.17, and npx semantic-release-monorepo --dry-run reaches the ENONPMTOKEN stage (expected locally — CI publishes via OIDC trusted publishing).

Separately: the Release CLI workflow

Run #23 installed 1777 packages fine and failed at the git push step:

403: The 'Microsoft Open Source' enterprise forbids access via a personal access
tokens (classic) if the token's lifetime is greater than 8 days.
→ EGITNOPERMISSION Cannot push to the Git repository.

The GH_TOKEN secret is a classic PAT expiring 2026-10-29 (~2 months), which enterprise policy rejects. Fixing it requires rotating the secret — options, best first:

1. A GitHub App token via actions/create-github-app-token (durable, no expiry churn, can be granted branch-protection bypass)
2. A fine-grained PAT (the 8-day rule targets classic PATs)
3. A classic PAT with a ≤ 8 day lifetime (works, but needs constant re-issuing)

Once the token is sorted, the pending fix(cli): commit from #190 will release as 1.6.1.