chore(deps): update deps, move to pnpm 12 and eslint 10

[kelsos]

Clears out the dependency dashboard for main. Everything here either cleared the 7 day minimumReleaseAge gate on its own or is a first party package we control.

Runtime and build

package	from	to
vitepress	2.0.0-alpha.17	2.0.0-alpha.19
vite (override)	8.0.16	8.2.2
vue, @vue/compiler-sfc, @vue/runtime-dom	3.5.35	3.5.42
@vitejs/plugin-vue	6.0.7	6.0.8
vitepress-plugin-llms	1.13.1	1.13.5
vitepress-plugin-tabs	0.9.0	0.9.1
markdown-it	14.2.0	14.3.1
oxc-minify	0.134.0	0.148.0
papaparse	5.5.3	5.7.0
@types/node	24.12.4	24.13.3
lint-staged	17.0.7	17.4.1

markdown-it deliberately stays on 14. Our only use is the MarkdownIt type import in .vitepress/plugins/markdown-fit-media.ts, and vitepress alpha.19 depends on @types/markdown-it ^14. Going to 15 would leave our types describing a different instance than the one vitepress passes in.

Toolchain

package	from	to
pnpm	11.5.1	12.1.0
eslint	9.39.4	10.9.1
@rotki/eslint-config	5.0.1	8.3.0
@rotki/eslint-plugin	1.3.2	1.8.0
eslint-plugin-tsdoc	(new)	0.5.2

• engines.pnpm widened to the 12.x range. pnpm@12.1.0 has npm provenance, and the workflows read the version from packageManager, so no CI pin to touch.
• eslint stops at 10.9.1. 10.10.0 landed on 2026-09-04 and is still inside the 7 day window.
• The two @rotki packages were published on 2026-09-09, so minimumReleaseAgeExclude: ['@rotki/*'] exempts them. The cooling off period is there for third party supply chain risk and buys us nothing on packages we publish ourselves. Everything else still goes through the gate.
• eslint-plugin-tsdoc is now an explicit devDependency. Config 8 enables tsdoc by default and calls ensurePackages, which drops into an interactive "do you want to install them?" prompt when the plugin is missing. That would hang CI.

Actions

All repinned by digest: checkout v6.0.3 to v7.0.1, setup-node v6.4.0 to v7.0.0, cache v5.0.5 to v6.1.0, pnpm/action-setup v6.0.10, crate-ci/typos v1.50.0, codeql-action v4.37.9, deploy-pages v5.0.1.

Lint fallout

The jump from config 5 to 8 brought new rules. 23 errors, all addressed:

• Heading levels no longer skip in usage-guides/settings/{accounting,general,interface}.md. Slugs derive from heading text, not depth, so every anchor is unchanged and no link moves. check:anchors and check:app-links both still pass.

• README gets a single H1 instead of four.

• redirects.ts: the @example block is fenced so TSDoc stops reading its object braces as malformed inline tags.

• vue-typescript.md: the ui-library linking snippet is valid JSON again, with the "adjust the path" note moved into the prose above it. jsonc did not help, the processor parses it strictly either way.

• scripts/check-*.mjs: autofixed to Array.from(x, fn) instead of [...x].map(fn).

• markdown/no-missing-link-fragments is off. It slugs headings the GitHub way and disagrees with vitepress on punctuation, flagging #all-valid-type-subtype-combinations and #public-network-with-traefik-basic-auth as broken. Both resolve correctly. I confirmed against the built HTML:

  $ grep -o 'id="[^"]*combinations[^"]*"' .vitepress/dist/usage-guides/tax-accounting/event-types.html
  id="all-valid-type-subtype-combinations"
  $ grep -o 'id="[^"]*traefik[^"]*"' .vitepress/dist/requirement-and-installation/docker.html
  id="public-network-with-traefik-basic-auth"
  

  pnpm check:anchors gates the same thing against vitepress' own slugger and runs in CI, so we are not losing coverage.

Verification

pnpm lint, pnpm build, check:images (221 images), check:anchors (69 pages), check:app-links (15 links) all pass. pnpm install --frozen-lockfile is clean and the lockfile passes pnpm's supply chain policies.

Once this is in, the other branches need the same sync.