fix(security): auto-remediate fixable vulnerabilities

[enyineer]

Automated by the daily Security Maintenance workflow.

Direct dependency range bumps

• MEDIUM tar 7.5.20 → ^7.5.21 (GHSA-r292-9mhp-454m)

Managed security overrides

• HIGH brace-expansion 5.0.7 → pinned to ^5.0.8 (CVE-2026-14257)

Needs manual attention (major-version fix only)

• HIGH react-router 7.18.1: only a major-version fix is available — bump manually

[changeset-bot]

🦋 Changeset detected

Latest commit: dc755ac

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@checkstack/backend	Patch
@checkstack/scripts	Patch
create-checkstack-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

✅ All PR Checks Passed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	✅ Passed
Security (container)	✅ Passed
E2E	✅ Passed

@enyineer All quality checks have passed. This PR is ready for your review.

[github-actions]

✅ All PR Checks Passed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	✅ Passed
Security (container)	✅ Passed
E2E	✅ Passed

@enyineer All quality checks have passed. This PR is ready for your review.

[github-actions]

❌ PR Checks Failed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	❌ Failed
Security (deps)	✅ Passed
Security (container)	✅ Passed
E2E	✅ Passed

❌ Integration Test Failures

Output not available.

How to fix: These are the real-services integration tests (*.it.test.ts). To reproduce locally, start the dev services with docker compose -f docker-compose-dev.yml up -d postgres redis, then run CHECKSTACK_IT=1 bun test it.test. Read the failing assertions and fix the implementation so the tests pass against real Postgres/Redis. Do not weaken or skip the tests.

@enyineer The above code quality issues were found in this PR. Please fix them before merging.

[github-actions]

✅ All PR Checks Passed

Check	Status
Typecheck	✅ Passed
Lint	✅ Passed
Deps	✅ Passed
Test	✅ Passed
Integration	✅ Passed
Security (deps)	✅ Passed
Security (container)	✅ Passed
E2E	✅ Passed

@enyineer All quality checks have passed. This PR is ready for your review.