chore: weekly maintenance — dep bumps

[arzafran]

Weekly dependency sweep. Bumped motion in the playground workspace from 12.40.0 → 12.42.2 (patch/minor, within its existing ^12.40.0 range). Build, lint, and playground build (astro check && astro build) all pass, matching the baseline on main (repo has no dedicated test script).

Findings (not acted on)

Major bumps available (not applied):

• @biomejs/biome 1.9.4 → 2.5.5 (major)
• typescript 5.9.3 → 7.0.2 (major, root + playground)
• react / react-dom (peer/dev, root + playground + packages/react) 18.3.1 → 19.2.8 (major)
• @types/react / @types/react-dom 18.x → 19.x (major, tracks React)
• astro (playground) 6.4.8 → 7.1.3 (major)
• @astrojs/react (playground) 5.0.7 → 6.0.1 (major)
• lorem-ipsum (playground) 2.0.10 → 3.0.0 (major)

All of the above are locked at the top of their current major range already — nothing left to bump without crossing a major version.

CI observations:

• .github/workflows/ci.yml pins actions/checkout@v4; current major is v7, which adds pwn-request-pattern protections for pull_request_target/workflow_run triggers. Worth a look — 3 majors behind.
• oven-sh/setup-bun@v2 is current, no action needed.
• No dedicated test script exists in package.json — CI only runs build and lint (library) and build (playground via astro check). Flagging in case that's intentional or an oversight.
• GitHub is now flagging 3 Dependabot vulnerabilities (2 moderate, 1 low) on the default branch — worth a look at the Security tab; not something this sweep resolves since it may require a major bump or source change.

Not merging — for review.

---

Generated by Claude Code

[arzafran]

Refreshed by this week's sweep — no material delta vs last week (same motion 12.40.0 → 12.42.2 bump re-applied against latest main; all other deps still pinned at the top of their current major range). New this week: GitHub is now surfacing 3 Dependabot alerts (2 moderate, 1 low) on main, added to the findings section above.

---

Generated by Claude Code

---

Generated by Claude Code