chore(deps): update all dependencies to latest (next 16.3.0, TypeScript 7)

[finallyjay]

Consolidated dependency update, superseding Dependabot PRs #51 (npm-minor-patch group, 28 updates) and #42 (typescript 7). Leaving those open for the maintainer to close.

Bumps

Dependencies

Package	From	To
next	16.2.11	16.3.0
react / react-dom	19.2.7	19.2.8
@radix-ui/react-avatar	1.2.2	1.2.6
@radix-ui/react-checkbox	1.3.7	1.3.11
@radix-ui/react-collapsible	1.1.16	1.1.20
@radix-ui/react-dialog	1.1.19	1.1.23
@radix-ui/react-dropdown-menu	2.1.20	2.1.24
@radix-ui/react-label	2.1.11	2.1.15
@radix-ui/react-progress	1.1.12	1.1.16
@radix-ui/react-select	2.3.3	2.3.7
@radix-ui/react-slot	1.3.0	1.3.3
@radix-ui/react-switch	1.3.3	1.3.7
@radix-ui/react-tabs	1.1.17	1.1.21
@radix-ui/react-toast	1.2.19	1.2.23
radix-ui	1.6.2	1.6.7
@hookform/resolvers	5.4.0	5.7.1
react-hook-form	7.81.0	7.84.0
lucide-react	1.23.0	1.28.0
recharts	3.9.2	3.10.1
slot-text	0.3.2	0.3.3
tailwind-merge	3.4.1	3.6.0

Dev dependencies

Package	From	To
typescript	6.0.3	7.0.2 (major)
jsdom	29.1.1	30.0.1 (major)
@types/react	19.2.17	19.2.18
@types/react-dom	19.2.3	19.2.4
tailwindcss / @tailwindcss/postcss	4.3.2	4.3.3
postcss	8.5.18	8.5.25
lint-staged	17.0.8	17.3.0
oxlint	1.73.0	1.76.0
oxfmt	0.58.0	0.61.0

Already current: date-fns 4.4.0, zod 4.4.3, sonner 2.0.7, pino 10.3.1, @types/node 26.1.2, clsx, class-variance-authority, husky, vitest 4.1.10, @vitest/coverage-v8, @testing-library/*, tw-animate-css.

Notes

• next 16.3.0 shipped inside pnpm's supply-chain minimum-release-age window, so it (and its platform binaries) is listed under minimumReleaseAgeExclude in pnpm-workspace.yaml. oxlint 1.77.0 / oxfmt 0.62.0 also exist but are inside the same window; I left those at the newest gate-passing versions (1.76.0 / 0.61.0) rather than piling on exclusions.
• Removed the undici: ^7.28.0 override: it existed to clear advisories pulled in transitively via jsdom. jsdom 30 depends on undici ^8.9.0 (resolves to 8.9.0), already past the patched line — the stale override would actually have forced jsdom back onto 7.x.
• slot-text 0.3.3 now probes whether its stylesheet applied and renders a plain-text fallback when it did not — always the case under jsdom — so two tests in test/animated-text.test.tsx that queried .slot-text were adapted to assert the aria-label contract on the root span (the contract the test itself documents). Browser behavior is unchanged.
• TypeScript 7.0.2 required no code changes; tsc --noEmit is clean.
• GitHub Actions: .github/workflows/ci.yml pins (checkout@v7, setup-node@v7, upload-artifact@v7, pnpm/action-setup@v6) already match the latest majors — nothing to refresh.

Checks (all passing locally, node 24.13.1 / pnpm 11.7.0)

• pnpm lint (oxlint + next typegen + tsc --noEmit) — clean
• pnpm test:coverage (vitest) — 85/85 tests, 12 files
• pnpm build (next build, standalone) — success
• pnpm format:check (oxfmt) — clean

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c586dd5a-2b1f-4ec4-8c3c-95ff2501a944

📥 Commits

Reviewing files that changed from the base of the PR and between 19535bb and d71c3e7.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• package.json
• pnpm-workspace.yaml
• test/animated-text.test.tsx

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (3)

**/*.{ts,tsx}

📄 CodeRabbit inference engine (CLAUDE.md)

**/*.{ts,tsx}: Use TypeScript strict mode for all TypeScript files
Use path alias @/* to map to project root

Files:

• test/animated-text.test.tsx

**/*.{css,tsx,ts}

📄 CodeRabbit inference engine (CLAUDE.md)

Use design tokens (surface-1 through surface-4, semantic colors, chart-1..5) instead of hardcoded color values

Files:

• test/animated-text.test.tsx

{package.json,pnpm-lock.yaml,.npmrc}

📄 CodeRabbit inference engine (CLAUDE.md)

Use pnpm as the package manager (pnpm 10.25)

Files:

• package.json

🔇 Additional comments (5)

package.json (2)

61-76: LGTM!

---

31-58: 📐 Maintainability & Code Quality

No removed lucide-react icons are used.

All imports use non-brand icons.

			> Likely an incorrect or invalid review comment.

pnpm-workspace.yaml (2)

8-20: LGTM!

---

22-23: 🔒 Security & Privacy | ⚡ Quick win

Other (CWE-1104)

Confirm the resolved undici version is outside the vulnerable range.

The comment states jsdom 30 depends on undici ^8.9.0, which is past the previously patched line, so the override was removed. Confirm this against the lockfile before merging, since removing this override without exact confirmation could reintroduce the previously mitigated advisory in the test toolchain.

#!/bin/bash
# Description: Confirm the resolved undici version brought in transitively by jsdom.
rg -n "^undici@" -A3 pnpm-lock.yaml
rg -n "jsdom@30" -A15 pnpm-lock.yaml | rg -n "undici"

test/animated-text.test.tsx (1)

24-32: LGTM!

Also applies to: 49-49

---

📝 Walkthrough

Summary by CodeRabbit

• Maintenance

  • Updated application and development tooling packages, including the framework, UI components, testing tools, and TypeScript.
  • Improved package installation safeguards for the latest framework release.
  • Removed an outdated security override now superseded by newer transitive dependencies.

• Tests

  • Strengthened animated text tests by verifying rendered content and accessibility more reliably.

Walkthrough

The pull request upgrades runtime and development dependencies, adjusts pnpm release-age policy settings, removes an obsolete undici override, and updates AnimatedText tests to use stable span queries.

Changes

Dependency and test maintenance

Layer / File(s)	Summary
Dependency and workspace updates package.json, pnpm-workspace.yaml	Runtime and development dependency versions are updated. The workspace excludes Next.js 16.3.0 packages from the release-age check and removes the obsolete undici override.
AnimatedText selector updates test/animated-text.test.tsx	Tests query the rendered span, verify its accessible name and text content, and use the same selector after rerendering.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• finallyjay/csgo-inventory-tracker#44: Updates overlapping dependencies, including Next.js, React, Radix UI, and tooling packages.
• finallyjay/csgo-inventory-tracker#45: Updates the same testing dependency.
• finallyjay/csgo-inventory-tracker#51: Updates overlapping dependency versions in package.json.

Suggested labels: dependencies, javascript

Suggested reviewers: copilot

Poem

A rabbit checks the packages bright,
With fresh green leaves for every byte.
The spans now speak, the tests agree,
Next hops past the aging tree.
undici rests; the build runs light.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency update and names the main version changes.
Description check	✅ Passed	The description provides a detailed summary, dependency changes, rationale, related PRs, and results for the reported checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/update-deps-2026-08-04

---

_{Comment @coderabbitai help to get the list of available commands.}