chore(deps): batch minor dependency updates across root and web packages

[aaight]

Summary

Batch minor/patch dependency updates across root and web package.json files — all within semver-compatible ranges. No major version bumps.

Card: https://trello.com/c/CHTKn96B/588-multiple-minor-dependency-updates-pending-oclif-core-opencode-ai-sdk-lucide-react-vitejs-plugin-react-various-tanstack-packages

Root package updates (package-lock.json)

• @oclif/core: 4.8.0 → 4.10.3
• @opencode-ai/sdk: 1.2.24 → 1.3.13
• @anthropic-ai/claude-agent-sdk: 0.2.42 → 0.2.90
• @trpc/client + @trpc/server: 11.10.0 → 11.16.0
• @sentry/node: 10.39.0 → 10.47.0
• bullmq: 5.66.4 → 5.72.0
• pg: 8.18.0 → 8.20.0
• llmist + @llmist/cli: 16.1.0 → 16.2.0
• hono: 4.12.7 → 4.12.9
• drizzle-orm: 0.45.1 → 0.45.2
• marklassian: 1.1.0 → 1.2.1
• dockerode: 4.0.9 → 4.0.10
• jira.js: 5.3.0 → 5.3.1
• eta: 4.5.0 → 4.5.1
• Dev: @commitlint/cli + @commitlint/config-conventional, @types/pg, @types/adm-zip, commander, drizzle-kit

Web package updates (web/package-lock.json + web/package.json)

• @tanstack/react-query: 5.75.5 → 5.96.1
• @tanstack/react-router: 1.121.0 → 1.168.10
• @trpc/client + @trpc/tanstack-react-query: 11.10.0 → 11.16.0
• tailwindcss + @tailwindcss/vite: 4.1.7 → 4.2.2
• lucide-react: 0.475.0 → 0.577.0 (manual range bump in package.json: ^0.475.0 → ^0.577.0)
• tailwind-merge: 3.3.0 → 3.5.0
• recharts: 3.8.0 → 3.8.1
• react-hook-form: 7.71.1 → 7.72.0

Excluded (major version bumps — not updated)

zod 4.x, vitest 4.x, typescript 6.x, @biomejs/biome 2.x, jsdom 29.x, lefthook 2.x, @vitejs/plugin-react 6.x, vite 8.x, lucide-react 1.x, @types/dockerode 4.x

Test plan

• TypeScript compilation: npm run typecheck — passes with zero errors
• Lint check: npm run lint — passes with 2 pre-existing warnings (no new issues)
• Unit tests: npm test — 369 test files, 7262 tests all passing
• Web build: cd web && npm run build — builds successfully (Vite 6.4.1 + Tailwind 4.2.2 + TanStack 1.168.10)
• Integration tests: Skipped — Docker not available in this environment (tests auto-skip when no DB reachable)

🤖 Generated with Claude Code

🕵️ claude-code · claude-sonnet-4-6 · run details

[nhopeatall]

LGTM — straightforward batch dependency update with no source code changes beyond the lucide-react range bump in web/package.json.

Verified:

• The lucide-react range bump (^0.475.0 → ^0.577.0) is necessary since 0.x semver ranges don't auto-resolve across minor versions. CI's TypeScript compilation confirms no icon renames/removals affect the 20+ consuming files.
• @tailwindcss/oxide 4.2.2 now requires Node >= 20; project requires Node >= 22 and CI uses Node 22 — fully compatible.
• @tanstack/react-router 1.168.x now requires Node >= 20.19 — also compatible.
• @trpc/client, @trpc/server, and @trpc/tanstack-react-query all resolve to 11.16.0 in both workspaces, maintaining version alignment.
• All 7 CI checks pass (lint, typecheck, unit tests, integration tests, Docker builds, CodeQL).
• Major version bumps (zod 4.x, vitest 4.x, typescript 6.x, etc.) are correctly excluded per the PR description.

🕵️ claude-code · claude-opus-4-6 · run details