chore(deps): bump low-risk patch and minor dependencies

[StiensWout]

Many pinned and in-range dependencies had drifted several patch or minor releases behind without anything forcing a refresh, so fixes upstream were not reaching the app.

This bumps the set with no breaking changes and one lockfile refresh:

• Web: React and React DOM 19.2.8, TanStack router and router plugin, react-pacer 0.23, base-ui 1.7, zustand, auto-animate 0.10, plugin-react 6.1, @vercel/config 0.7, jose 6.2.10 (catalog). The route tree is regenerated because the newer router plugin sorts imports.
• Mobile: Expo SDK 57 point releases (expo, expo-constants, expo-updates and friends, plus the matching overrides and release-age excludes), react-navigation native and elements, shiki 4.4, react-native-svg, tabler icons. @types/react now shares web's range so one copy resolves.
• Desktop: electron-updater 6.8.9, react-grab 0.2.0, acorn.
• Server: OpenCode SDK 1.18.
• Tooling: @oxlint/plugins 1.79.0 to match the oxlint that vite-plus 0.3.0 bundles.

Deliberately left out: Electron (#8940 covers it), Effect (stays on beta.103), the Clerk family, relay-only packages, anything with a local patch, and all majors. Two candidates were tried and reverted: playwright-core 1.62 changes the core bundle layout that the desktop preview runtime extraction reads, and @types/bun 1.4.0 breaks process.on typings in the server.

Verified with typecheck for web, desktop, server, mobile and marketing, lint, and the web, desktop, mobile, shared, and server OpenCode test suites. Frozen install passes.

Made by Claude Fable 5.1 running in T3 Code.

---

Note

Medium Risk
Broad surface-area version drift with a large @opencode-ai/sdk jump on the server’s agent provider path; no application logic changes, but integration regressions are the main watch item.

Overview
This PR refreshes patch and minor dependency versions across the monorepo so upstream fixes can land without intentional major or high-risk upgrades (Electron, Effect, Clerk, playwright-core, etc. stay put per the PR notes).

Web moves React/React DOM to 19.2.8, bumps TanStack Router and router-plugin, react-pacer, @base-ui/react, zustand, @formkit/auto-animate, @vitejs/plugin-react, @vercel/config, and @pierre/trees; routeTree.gen.ts is regenerated with reordered imports only (newer plugin sorting—no route behavior change).

Mobile takes Expo SDK 57 point releases across many expo-* packages, plus react-navigation, shiki 4.4.x, react-native-svg, icons, and aligns @types/react with web.

Desktop bumps electron-updater, react-grab 0.2.x, and acorn. Marketing bumps astro and related check/config tooling. Server bumps @opencode-ai/sdk to ^1.18.27 (provider/OpenCode integration). Root and oxlint-plugin align @oxlint/plugins to 1.79 with vite-plus’s bundled oxlint.

^{Reviewed by Cursor Bugbot for commit 18893a3f8e2bd7992098cd12dbef42c6c0230360. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bump low-risk patch and minor dependencies across apps

• Updates dependencies in desktop, marketing, mobile, server, web, and oxlint-plugin-t3code package manifests to newer patch and minor versions.
• Regenerates web route tree in routeTree.gen.ts.
• Updates jose catalog entry and Expo package overrides/exclusions in pnpm-workspace.yaml.
• Risk: @opencode-ai/sdk in apps/server/package.json jumps from 1.3.15 to 1.18.27, which may introduce breaking changes or behavioral differences in server SDK usage.

^{Macroscope summarized 0a7be9a.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This dependency refresh spans multiple production applications and includes a substantial OpenCode SDK jump on the server provider path, alongside Expo/native, web router/UI, Astro, and desktop runtime updates. The route-tree edit is mechanical, but the aggregate runtime surface is broad enough to require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Closing as part of the open-PR backlog sweep (wave 2).

Reason: Stale conflicting lockfile bump with no unique product value

Reopen if this is still wanted and you’re willing to rebase onto current main.