chore: pin coder to v2.33.1 and bump deps (#941)

- Pin coder to github:coder/coder#v2.33.1 (was #main) for reproducible
  builds; document the tagging convention in CONTRIBUTING.md.
- Bump axios, zod, eslint, typescript-eslint, jsdom, globals,
  @eslint-react/eslint-plugin, @tanstack/react-query, react,
  react-dom, vite to latest minors/patches.
- Promote @eslint-react v5's web-api-no-leaked-fetch and
  jsx-no-leaked-dollar from warn to error.

Author: EhabY

CONTRIBUTING.md

@@ -193,8 +193,11 @@ Some dependencies are not directly used in the source but are required anyway.
 - `bufferutil` and `utf-8-validate` are peer dependencies of `ws`.
 - `ua-parser-js` and `dayjs` are used by the Coder API client.
 
-The coder client is vendored from coder/coder. Every now and then, we should be running `pnpm update coder`
-to make sure we're using up to date versions of the client.
+The coder client is vendored from coder/coder. Pin it to a release tag in
+`pnpm-workspace.yaml` (e.g. `coder: github:coder/coder#v2.33.1`), not `#main`.
+A tag gives reproducible builds and is not re-fetched on every `pnpm install`,
+unlike `#main` which can drift between installs. To update, bump the tag and
+run `pnpm install` (or `pnpm update coder`).
 
 After running `pnpm update`, always run `pnpm dedupe` to consolidate duplicate
 package versions across the workspace. Without this, workspace packages can

eslint.config.mjs

@@ -187,6 +187,8 @@ export default defineConfig(
 		rules: {
 			// React Compiler auto-memoizes; exhaustive-deps false-positives on useCallback
 			"@eslint-react/exhaustive-deps": "off",
+			"@eslint-react/web-api-no-leaked-fetch": "error",
+			"@eslint-react/jsx-no-leaked-dollar": "error",
 		},
 	},
 

package.json

@@ -673,7 +673,7 @@
 		"@abraham/reflection": "^0.13.0",
 		"@peculiar/x509": "^2.0.0",
 		"@repo/shared": "workspace:*",
-		"axios": "1.15.0",
+		"axios": "1.16.0",
 		"date-fns": "catalog:",
 		"eventsource": "^4.1.0",
 		"fflate": "^0.8.2",
@@ -687,10 +687,10 @@
 		"strip-ansi": "^7.2.0",
 		"ua-parser-js": "^1.0.41",
 		"ws": "^8.20.0",
-		"zod": "^4.3.6"
+		"zod": "^4.4.3"
 	},
 	"devDependencies": {
-		"@eslint-react/eslint-plugin": "^4.2.3",
+		"@eslint-react/eslint-plugin": "^5.7.4",
 		"@eslint/js": "^10.0.1",
 		"@eslint/markdown": "^8.0.1",
 		"@rolldown/plugin-babel": "catalog:",
@@ -707,8 +707,8 @@
 		"@types/ua-parser-js": "0.7.39",
 		"@types/vscode": "1.106.0",
 		"@types/ws": "^8.18.1",
-		"@typescript-eslint/eslint-plugin": "^8.59.1",
-		"@typescript-eslint/parser": "^8.59.1",
+		"@typescript-eslint/eslint-plugin": "^8.59.2",
+		"@typescript-eslint/parser": "^8.59.2",
 		"@vitejs/plugin-react": "catalog:",
 		"@vitest/coverage-v8": "^4.1.5",
 		"@vscode/test-cli": "^0.0.12",
@@ -722,20 +722,20 @@
 		"dayjs": "^1.11.20",
 		"electron": "39.8.5",
 		"esbuild": "^0.28.0",
-		"eslint": "^10.2.1",
+		"eslint": "^10.3.0",
 		"eslint-config-prettier": "^10.1.8",
 		"eslint-import-resolver-typescript": "^4.4.4",
 		"eslint-plugin-import-x": "^4.16.2",
 		"eslint-plugin-package-json": "^0.91.2",
-		"globals": "^17.5.0",
-		"jsdom": "^29.1.0",
+		"globals": "^17.6.0",
+		"jsdom": "^29.1.1",
 		"jsonc-eslint-parser": "^3.1.0",
 		"memfs": "^4.57.2",
 		"prettier": "^3.8.3",
 		"react": "catalog:",
 		"react-dom": "catalog:",
 		"typescript": "catalog:",
-		"typescript-eslint": "^8.59.1",
+		"typescript-eslint": "^8.59.2",
 		"utf-8-validate": "^6.0.6",
 		"vite": "catalog:",
 		"vitest": "^4.1.5"