chore(deps): remove nothing, bump 12 safe patch/minor deps (pst-whg3)

[SeanOC]

Dependency audit (bead pst-whg3). Two parts: remove verified-unused deps, and apply safe patch/minor bumps. Majors/risky bumps are listed for mayor review, not applied.

Removed (verified unused)

None. All 18 npm dependencies are genuinely used:

• @vercel/blob — lib/wasm/export-cache.ts (dynamic import)
• google-auth-library — lib/render-service/auth.ts
• @vercel/config — vercel.ts
• postcss — postcss.config.mjs (via @tailwindcss/postcss)
• jsdom — @testing-library/react environment
• All others are imported directly in app/components/hooks/lib.

Python ecosystem is lockfile-free: CI installs pytest, numpy, trimesh, rtree, pillow ad-hoc; the only requirements.txt (.claude/skills/scad-send/) pins PyYAML>=6.0 and a git Bambu cloud lib, both used by that skill. Nothing to remove or bump there.

Bumped (patch/minor only, lockfile kept consistent)

Package	From	To
next	16.2.10	16.3.3
react / react-dom	19.2.7	19.2.8
@vercel/blob	2.6.1	2.8.0
google-auth-library	10.9.0	10.9.1
@playwright/test	1.61.1	1.62.1
@tailwindcss/postcss	4.3.2	4.3.3
tailwindcss	4.3.2	4.3.3
@testing-library/react	16.3.2	16.3.3
@types/react	19.2.17	19.2.18
@types/react-dom	19.0.0	19.2.5
postcss	8.5.16	8.5.26

next 16.3.x also fixes a bundled-lodash CVE (CVE-2025-13465) per its changelog.

Proposed majors / risky — NOT applied, for mayor review

• three + @types/three 0.169.0 → 0.185.x — breaks APIs per minor and drives StlViewer; needs a dedicated migration + visual-verification pass (tracked as st-3js).
• vitest 2.1.9 → 4.1.11 — two majors; runs both unit tests and the param-sweep guard and carries the audit's critical advisory (tracked as st-35j).
• typescript 5.9.3 → 7.0.2 — TS 6/7 native compiler is fresh; revisit once Next/ecosystem support settles.
• @types/node 22.20.1 → 26.x — tracks runtime; CI is pinned to Node 22, bump alongside a Node upgrade.
• @vercel/config 0.2.1 → 0.7.0 — does not clear its audit advisory (fixed-forward version unavailable); 0.x API churn risk for zero benefit.

Gates

• npm test (vitest): 218/218 passed
• npm run build (Next.js prod build): clean
• npm audit: 10 → 9 advisories (remaining are dev-only / upstream-owned, documented in docs/deps-review-2026-07.md)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stuff	Ready	Preview	Aug 28, 2026 4:45pm

[SeanOC]

Codex gate review — pass

Reviewed the exact head 3b1bc0f46543f3bc3a901b48edec8d7101e16eed against origin/main. The diff is confined to package.json and package-lock.json; the 12 direct patch/minor bumps and their transitive lockfile updates are consistent, and no model, invariant, application, or vendored-library contract changes are introduced.

Verification performed:

• Manifest and lockfile roots match.
• npm ci --dry-run resolves cleanly.
• Clean install: npm test passes 218/218 tests.
• Clean production build succeeds with Next.js 16.3.3.
• Production audit improves from 4 high + 1 moderate to 1 pre-existing moderate (nested undici under @vercel/blob).
• CI unit, e2e, render, and Vercel checks pass on this SHA.

No blocking findings. Full review details are recorded on the gate bead.