Lock file maintenance

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "before 6:00am on the first day of the month" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mui-bot]

Netlify deploy preview

https://deploy-preview-46634--material-ui.netlify.app/

Bundle size report

Bundle	Parsed Size	Gzip Size
@mui/material	🔺+1B(0.00%)	🔺+5B(0.00%)
@mui/lab	🔺+1B(0.00%)	🔺+4B(+0.01%)
@mui/system	0B(0.00%)	0B(0.00%)
@mui/utils	0B(0.00%)	0B(0.00%)

Details of bundle changes

Generated by 🚫 dangerJS against 5d7dd1d

[oliviertassinari]

We have a lot of dependencies security alerts in https://github.com/mui/material-ui/security/dependabot vs. https://github.com/mui/mui-x/security/dependabot that has almost none. The only difference I'm aware of between the two repositories is that here we don't merge the "Lock file maintenance" PRs, while they do. Trying this out.

[oliviertassinari]

The only difference I'm aware of between the two repositories is that here we don't merge the "Lock file maintenance" PRs, while they do. Trying this out.

Ok, it didn't help much, the root seems closer to be about: dependabot/dependabot-core#4364. Most of the alerts are not about the root pnpm-lock.yaml file.

I have closed all the ones related to a different manifest file: https://github.com/mui/material-ui/security/dependabot?q=is%3Aopen+-manifest%3Apnpm-lock.yaml+.

The rest of the issues https://github.com/mui/material-ui/security/dependabot seems to come from:

• Outdated @toolpad/core: [internal] Remove dead @toolpad/core dependency #46730
• Outdated Katex [internal] Upgrade KaTeX #46731
• Outdated claudia
• Outdated karma
• Imask Fix for CVE-2025-27789 vulnerability. uNmAnNeR/imaskjs#1115
• material-ui/apps/pigment-css-vite-app/package.json that fix specific versions