chore(deps): update all non-major dependencies

Author: renovate[bot]

.devcontainer/devcontainer.json

@@ -3,7 +3,7 @@
   "image": "mcr.microsoft.com/devcontainers/base:trixie",
   "features": {
     "ghcr.io/devcontainers/features/node:1": {
-      "version": "16.18.1"
+      "version": "16.20.2"
     },
     "ghcr.io/devcontainers/features/php:1": {
       "version": "8.4",

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
           # lint tools themselves need it: cspell requires >=22.18.0,
           # markdownlint-cli2 >=22, commitlint >=22.12.0. This job only
           # runs root-level tooling, never touches the app's own runtime.
-          node-version: '22'
+          node-version: '22.23.2'
           cache: 'npm'
 
       - run: npm install
@@ -207,7 +207,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v7
         with:
-          node-version: '22'
+          node-version: '22.23.2'
 
       - name: Run the script tests with coverage
         run: npm run test:scripts:coverage

.gitlab-ci.yml

@@ -24,7 +24,7 @@ cache:
   # tools themselves need it: cspell requires >=22.18.0, markdownlint-cli2
   # >=22, commitlint >=22.12.0. This template only runs root-level
   # tooling, never touches the app's own runtime.
-  image: node:22
+  image: node:22.23.2
   cache:
     key:
       files:
@@ -201,7 +201,7 @@ lint:vale:
     - vale README.md
 
 .php-node-setup:
-  image: php:8.4
+  image: php:8.5
   before_script:
     - apt-get update -yqq
     - apt-get install -yqq $PHP_APT_PACKAGES python3 python3-setuptools build-essential
@@ -253,7 +253,7 @@ test_unit:
 # and node:assert, so they run on a modern Node with nothing installed.
 test_scripts:
   stage: test
-  image: node:22
+  image: node:22.23.2
   needs: []
   script:
     - npm run test:scripts:coverage
@@ -440,7 +440,7 @@ test_consumer_install:
   extends: .php-node-setup
   # The documented minimum, so a pass means the lock and the provisioning
   # actually work there - not just on a newer PHP.
-  image: php:8.3
+  image: php:8.5
   stage: test
   needs: []
   script:
@@ -456,7 +456,7 @@ test_consumer_install:
 # fail loudly, and a too-old PHP must be rejected by the preflight.
 test_install_guardrails:
   stage: test
-  image: node:22
+  image: node:22.23.2
   needs: []
   script:
     # npm install without PHP: exits 0 and points at `npm run setup`.

.nvmrc

@@ -1 +1 @@
-16.18.1
+16.20.2

drupal/composer.json

@@ -15,16 +15,16 @@
         }
     ],
     "require": {
-        "composer/installers": "^2.2",
-        "cweagans/composer-patches": "^2.0@beta",
+        "composer/installers": "^2.3.0",
+        "cweagans/composer-patches": "^2.0.0@beta",
         "drupal/core-composer-scaffold": "~11",
         "drupal/core-project-message": "~11",
         "drupal/core-recommended": "~11",
-        "drupal/decoupled_router": "^2.0 <2.0.7",
-        "drupal/druxt": "^1.2",
+        "drupal/decoupled_router": "^2.0.7 <2.0.8",
+        "drupal/druxt": "^1.2.1",
         "drupal/simple_oauth": "^6",
         "drush/drush": "^13",
-        "vlucas/phpdotenv": "^5.5"
+        "vlucas/phpdotenv": "^5.7.0"
     },
     "conflict": {
         "drupal/drupal": "*"

drupal/composer.lock

@@ -5,8 +5,8 @@
 # bundled with Node). This Node version bundles npm 8.19.2, matching
 # package.json's "packageManager" field.
 [tools]
-node = "16.18.1"
-php = "8.4"
+node = "16.20.2"
+php = "8.5.10"
 
 [tasks.setup]
 description = "Install frontend deps, provision Drupal (SQLite), start the backend."

mise.toml

@@ -1,2 +1,2 @@
 [tools]
-node = "16.18.1"
+node = "16.20.2"

nuxt/.mise.toml

@@ -1 +1 @@
-16.18.1
+16.20.2