deps: bump react 19.3.0, next 16.3.5, lucide-react 1.45.0

[AdamEXu]

What & why

Daily aged frontend dependency bumps for 2026-09-18. Caret ranges preserved where they already existed; lockfile pins the listed versions.

Package	From	To
react	19.2.8	19.3.0
react-dom	19.2.8	19.3.0
next	16.3.4	16.3.5
eslint-config-next	16.3.4	16.3.5
lucide-react	^1.44.0	^1.45.0 (lock 1.45.0)
@types/react	^19.2.18	^19.3.0 (lock 19.3.0)
@types/react-dom	^19.2.5	^19.3.0 (lock 19.3.0)

posthog-js stays on the intentional range >=1.422.1 <1.425.0.

Held too fresh

• fumadocs-core / fumadocs-ui 16.15.11 (keep 16.15.9)
• lucide-react ≥1.46 / 1.47
• fumadocs-mdx 15.4.1

Deferred majors

• fumadocs 17
• TypeScript 7
• ESLint 10

Area

• Frontend
• Backend
• Scraper
• Convex
• Infra / tooling

How tested

• cd frontend && pnpm typecheck — pass
• cd frontend && pnpm build — pass (Next.js 16.3.5 / Turbopack)
• cd frontend && pnpm lint — still reports the existing non-blocking eslint backlog (CI continue-on-error); no new app code in this PR

Security checklist

• Endpoints returning user data enforce ownership / authorization (no IDOR — a user cannot read another user's data). N/A — frontend dependency bump only.
• @auth_required is applied to routes that need authentication. N/A
• No SSRF: any outbound/scraped URL is validated (scheme + host) before it is fetched. N/A
• No secrets committed — no .env, *.db, keys, or credentials in the diff.
• Flask debug mode is not forced on in a production code path. N/A
• OAuth tokens stay encrypted at rest and are never logged or returned in responses. N/A

Checks

• cd frontend && pnpm typecheck passes.
• cd frontend && pnpm build passes.
• cd frontend && pnpm lint — pre-existing backlog; CI treats lint as a non-blocking ratchet.
• Backend still starts and affected endpoints work (make dev-backend). N/A — no backend changes.

  

[greptile-apps]

Confidence Score: 5/5

The dependency update appears safe to merge, with no concrete compatibility, lockfile, or security regression identified.

Summary

This PR updates the frontend’s React ecosystem, Next.js, Lucide, and corresponding development dependencies.

• Aligns React and React DOM at 19.3.0.
• Updates Next.js and eslint-config-next together to 16.3.5.
• Regenerates the pnpm lockfile with consistent peer and transitive dependency snapshots.

_{Reviews (1) · Last reviewed commit: "deps: bump react 19.3.0, next 16.3.5, lu..."}