build(deps): let the daily update move overridden packages

CLAUDE.md

@@ -21,7 +21,8 @@ One GitHub release `agenthits-vX.Y.Z` covers a batch of work, not a single PR (o
 
 `.github/workflows/deps-auto-update.yml` runs every day at 03:00 UTC (manually: `gh workflow run deps-auto-update.yml --repo TaskFlow-Systems/dokploy --ref AgentHits-Dev`). It runs `bun update --recursive` within the `package.json` ranges (minor and patch, direct and transitive packages, versions at least one day old), then `bun audit`, and keeps one PR `зависимости: автообновление библиотек` from `deps/auto-update` into `AgentHits-Dev`, rebuilt daily until it is merged. It starts `pull-request.yml` on the branch through `workflow_dispatch`; judge the PR by that run. It never merges. The same workflow runs in the owner's other projects; it replaced Dependabot for Bun, which moves only direct dependencies. It needs "Allow GitHub Actions to create and approve pull requests" in the repo's Actions settings.
 
-- Held packages stay pinned to exact versions (`better-auth`, `@better-auth/*`, `stripe`, `@stepperize/react`, `@dokploy/trpc-openapi`) or `~` (`ssh2`), and the root `overrides` are exact, so the workflow does not move them. Keep new holds pinned the same way.
+- Held packages stay pinned to exact versions (`better-auth`, `@better-auth/*`, `better-call`, `@better-fetch/fetch`, `stripe`, `@stepperize/react`, `@dokploy/trpc-openapi`) or `~` (`ssh2`), in their `package.json` and in the root `overrides`, so the workflow does not move them. Keep new holds pinned the same way.
+- Every other root override is a range `>=<fixed version> <next major>` (for `0.x`, `<next minor>`), so the override keeps the fixed floor and the workflow still moves the package. A security override follows the same form; an exact version there freezes the package and can silently override a newer direct dependency.
 - Major updates are done by hand, one PR each (the `dokploy-upgrader` agent), with `bun add <pkg>@<ver> --minimum-release-age=86400`.
 - The one-day age is `minimumReleaseAge` in `bunfig.toml` and `MIN_RELEASE_AGE` in the workflow; change both together.
 - A commit pushed to the branch of the open PR stops its daily rebuild until the PR is merged or closed.

apps/dokploy/package.json

@@ -105,16 +105,16 @@
 		"dockerode": "5.0.1",
 		"dompurify": "^3.4.17",
 		"dotenv": "18.0.9",
-		"drizzle-orm": "0.45.4",
+		"drizzle-orm": "^0.45.4",
 		"drizzle-zod": "0.8.3",
 		"fancy-ansi": "^0.2.2",
 		"input-otp": "^1.5.0",
 		"js-cookie": "^3.0.8",
-		"lodash": "4.18.1",
+		"lodash": "^4.18.1",
 		"lucide-react": "^1.61.0",
 		"micromatch": "4.0.8",
 		"nanoid": "6.0.2",
-		"next": "16.4.3",
+		"next": "^16.4.3",
 		"next-themes": "^0.4.6",
 		"nextjs-toploader": "^3.9.17",
 		"node-os-utils": "3.1.0",
@@ -124,7 +124,7 @@
 		"octokit": "5.0.5",
 		"pino": "10.4.0",
 		"pino-pretty": "13.2.0",
-		"postgres": "3.4.9",
+		"postgres": "^3.4.9",
 		"public-ip": "8.0.0",
 		"qrcode": "^1.5.4",
 		"radix-ui": "^1.8.1",
@@ -175,7 +175,7 @@
 		"@types/swagger-ui-react": "^5.18.0",
 		"@types/ws": "8.18.2",
 		"drizzle-kit": "^0.31.11",
-		"esbuild": "0.28.2",
+		"esbuild": "^0.28.2",
 		"lint-staged": "^17.6.0",
 		"memfs": "^4.80.0",
 		"simple-icons": "^16.36.0",

apps/schedules/package.json

@@ -13,7 +13,7 @@
 		"@hono/zod-validator": "0.9.1",
 		"bullmq": "5.81.5",
 		"dotenv": "^18.0.9",
-		"drizzle-orm": "0.45.4",
+		"drizzle-orm": "^0.45.4",
 		"hono": "^4.13.13",
 		"ioredis": "5.11.1",
 		"pino": "10.4.0",

package.json

@@ -28,7 +28,7 @@
 		"@biomejs/biome": "2.6.2",
 		"@types/node": "^26.6.5",
 		"dotenv": "18.0.9",
-		"esbuild": "0.28.2",
+		"esbuild": "^0.28.2",
 		"lint-staged": "^17.6.0",
 		"node-gyp": "13.1.0",
 		"tsx": "4.23.15"
@@ -49,23 +49,23 @@
 	},
 	"overrides": {
 		"better-auth": "1.7.12",
-		"next": "16.4.2",
+		"next": ">=16.4.3 <17.0.0",
 		"better-call": "1.4.4",
 		"@better-auth/utils": "0.5.0",
 		"@better-fetch/fetch": "1.3.2",
-		"drizzle-orm": "0.45.4",
-		"esbuild": "0.28.2",
-		"h3": "1.15.11",
-		"hono": "4.13.13",
-		"js-yaml": "4.3.2",
-		"lodash": "4.18.1",
-		"postcss": "8.5.28",
-		"postgres": "3.4.9",
+		"drizzle-orm": ">=0.45.4 <0.46.0",
+		"esbuild": ">=0.28.2 <0.29.0",
+		"h3": ">=1.15.11 <2.0.0",
+		"hono": ">=4.13.13 <5.0.0",
+		"js-yaml": ">=4.3.2 <5.0.0",
+		"lodash": ">=4.18.1 <5.0.0",
+		"postcss": ">=8.5.28 <9.0.0",
+		"postgres": ">=3.4.9 <4.0.0",
 		"ssh2": "1.16.0",
 		"tar": ">=7.5.19 <8.0.0",
 		"protobufjs": ">=7.5.5 <8.0.0",
-		"vite": "8.3.4",
-		"@codemirror/state": "6.7.6",
+		"vite": ">=8.3.4 <9.0.0",
+		"@codemirror/state": ">=6.7.6 <7.0.0",
 		"axios": ">=1.20.0 <2.0.0",
 		"proxy-addr": ">=2.0.8 <3.0.0",
 		"source-map-js": ">=1.2.2 <2.0.0",
@@ -76,8 +76,8 @@
 		"ip-address": ">=10.7.4 <11.0.0",
 		"body-parser": ">=2.4.0 <3.0.0",
 		"fast-uri": ">=3.1.9 <4.0.0",
-		"@tailwindcss/typography>postcss-selector-parser": "7.1.6",
-		"remarkable>argparse": "2.0.1",
+		"@tailwindcss/typography>postcss-selector-parser": ">=7.1.6 <8.0.0",
+		"remarkable>argparse": ">=2.0.1 <3.0.0",
 		"inngest>zod": "^4.6.7",
 		"@ai-sdk/provider-utils>undici": "^7.30.1",
 		"@dotenvx/dotenvx>undici": "^7.30.1",

packages/server/package.json

@@ -72,9 +72,9 @@
     "dockerode": "5.0.1",
     "dotenv": "18.0.9",
     "drizzle-dbml-generator": "0.10.0",
-    "drizzle-orm": "0.45.4",
+    "drizzle-orm": "^0.45.4",
     "drizzle-zod": "0.8.3",
-    "lodash": "4.18.1",
+    "lodash": "^4.18.1",
     "micromatch": "4.0.8",
     "nanoid": "6.0.2",
     "node-os-utils": "3.1.0",
@@ -84,7 +84,7 @@
     "octokit": "5.0.5",
     "pino": "10.4.0",
     "pino-pretty": "13.2.0",
-    "postgres": "3.4.9",
+    "postgres": "^3.4.9",
     "public-ip": "8.0.0",
     "qrcode": "^1.5.4",
     "react": "19.3.1",
@@ -116,7 +116,7 @@
     "@types/ws": "8.18.2",
     "auth": "1.7.12",
     "drizzle-kit": "^0.31.11",
-    "esbuild": "0.28.2",
+    "esbuild": "^0.28.2",
     "esbuild-plugin-alias": "0.2.1",
     "rimraf": "6.1.3",
     "tsc-alias": "1.9.9",