deps: bump lucide-react to 1.41.0 and fumadocs to 16.15.6

[AdamEXu]

What & why

Frontend-only dependency bump. Supply-chain OK for lucide-react@1.41.0 and fumadocs-core/fumadocs-ui@16.15.6 (>=7 days, OSV clean).

Bumped

• lucide-react: ^1.39.0 / lock 1.39.0 → ^1.41.0 / lock 1.41.0
• fumadocs-core: ^16.15.5 → ^16.15.6 (lock 16.15.6)
• fumadocs-ui: ^16.15.5 → ^16.15.6 (lock 16.15.6)

Skipped (fresh majors/minors or out of scope)

• next — leave at 16.3.4
• react / react-dom — skip 19.3.0 (too fresh); stay on 19.2.8
• fumadocs-mdx — leave as-is (major line differs)
• fumadocs past 16.15.6 — newer than 16.15.6 are under 7 days
• katex past 0.18.5
• posthog-js range — keep >=1.422.1 <1.425.0
• TypeScript 7
• ESLint 10
• Backend Python pins — not in this PR

Area

• Frontend
• Backend
• Scraper
• Convex
• Infra / tooling

How tested

• pnpm add lucide-react@1.41.0 fumadocs-core@16.15.6 fumadocs-ui@16.15.6 in frontend/
• Lockfile resolved to lucide-react@1.41.0, fumadocs-core@16.15.6, fumadocs-ui@16.15.6
• pnpm typecheck passed
• pnpm lint still fails on pre-existing app issues (setState-in-effect, unused vars, generated .source/ files); none of those files changed in this PR

Security checklist

• Endpoints returning user data enforce ownership / authorization (no IDOR — a user cannot read another user's data). N/A — frontend dep bump only
• @auth_required is applied to routes that need authentication. N/A
• No SSRF: any outbound/scraped URL is validated (scheme + host) before it is fetched. N/A
• No secrets committed — no .env, *.db, keys, or credentials in the diff.
• Flask debug mode is not forced on in a production code path. N/A
• OAuth tokens stay encrypted at rest and are never logged or returned in responses. N/A

Checks

• cd frontend && pnpm lint passes. (pre-existing failures; not introduced here)
• Backend still starts and affected endpoints work (make dev-backend). N/A — no backend changes

  

[greptile-apps]

Greptile Summary

This PR updates three frontend dependencies and refreshes their transitive lockfile resolutions.

• Updates fumadocs-core and fumadocs-ui together from 16.15.5 to 16.15.6.
• Updates lucide-react from 1.39.0 to 1.41.0.
• Replaces Fumadocs UI's transitive cnfast dependency with cn.
• Keeps peer dependency versions aligned with the repository's React, Next.js, and Node.js environment.

Confidence Score: 5/5

The dependency updates appear safe to merge, with compatible peer requirements and deterministic CI and deployment installations.

No actionable failure remains: the lockfile is internally consistent, Fumadocs packages are compatibly paired, and all supported installation and runtime paths use Node 22.

Important Files Changed

Filename	Overview
frontend/package.json	Updates the requested Fumadocs and Lucide dependency ranges without introducing an incompatible peer requirement.
frontend/pnpm-lock.yaml	Resolves the requested versions consistently, including the compatible Node 20+ transitive cn package.

_{Reviews (1): Last reviewed commit: "deps: bump lucide-react to 1.41.0 and fu..." | Re-trigger Greptile}