chore: update server dependencies

[jackshim415]

Summary

• update direct production and development dependencies to their latest compatible releases
• refresh the npm lockfile and add direct lint/type dependencies required by the checked-in configuration
• retain Prisma 6, Express 4, and TypeScript 5.9 because their newer major versions require application migrations

Validation

• npm exec prisma generate
• npm run build
• npm run lint (passes with existing warnings)

[railway-app]

🚅 Environment lovat-server-pr-63 in lovat has no services deployed.

[Copilot]

🟡 Changes recommended

The update introduces a Node runtime/types mismatch (@types/node 26 vs Node 22) and brings in explicitly deprecated transitive packages (glob@7, rimraf@2) flagged for security risk.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the server’s production and development npm dependencies and refreshes the lockfile to reflect the new resolved dependency graph, while keeping Prisma/Express/TypeScript on the current major versions.

Changes:

• Bumped multiple runtime dependencies (e.g., Express, Redis, Resend, Jose, Zod, axios).
• Updated lint/type tooling dependencies (ESLint, TypeScript, typescript-eslint and related packages).
• Regenerated package-lock.json for the updated dependency set.

File summaries

File	Description
package.json	Updates direct prod/dev dependencies (including ESLint/TS tooling and type packages).
package-lock.json	Regenerates the lockfile with updated resolved versions and new transitive dependencies.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The updated lockfile includes explicitly deprecated/vulnerable transitive packages (e.g., glob@7 via deprecated tooling) and the PR adds questionable production dependencies (e.g., @types/react) that should be cleaned up before approval.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

package.json:60

• ts-node-dev does not appear to be used by any npm script (the dev script uses tsx watch), and it currently pulls in deprecated tooling (e.g., rimraf@2 -> glob@7). If it’s not needed, removing ts-node-dev will reduce dependency footprint and avoid carrying deprecated transitive packages.

package.json:23

• @types/react is a type-only package and there are no React/JSX references in src/ or in the checked-in ESLint/TS config, so including it under production dependencies unnecessarily increases the runtime install surface (and may be confusing to deploy environments). Consider removing it entirely, or (if some tooling truly needs it) moving it to devDependencies, then regenerating the lockfile.

    "@prisma/extension-accelerate": "^1.3.0",
    "@slack/web-api": "^8.1.1",
    "@types/react": "^19.2.18",
    "axios": "^1.20.0",

• Files reviewed: 1/2 changed files
• Comments generated: 0 new
• Review effort level: Lite