v0.6.0

Frontend framework upgrade, landed as separate verifiable steps rather than one bundled dependency PR.

Changed

• React 18 to 19, and Next.js 15.5 to 16.3.
• Next 16 removes next lint, so linting moved to the ESLint CLI. .eslintrc.json became eslint.config.mjs in flat-config form and the lint script is now eslint .. ESLint stays on 9.x and TypeScript on 5.x: eslint-config-next bundles an eslint-plugin-react that calls the context.getFilename() ESLint 10 removed, and typescript-eslint refuses to load against TypeScript 7.
• Dependabot now holds back typescript 7, eslint 10 and tailwindcss 4. Web deps update as one group, so a single incompatible major was turning the whole batch red and blocking the safe bumps behind it.

Fixed

• Every brace-containing glob threw TypeError: expand is not a function. The brace-expansion override pinned the whole tree to 5.0.9, which is ESM-only, but minimatch@3 needs the v1 CommonJS default export. Each vulnerable major is now pinned to its own patched release, so the advisories stay closed and both API shapes resolve.
• The hero event stream called setCount synchronously inside an effect body, causing cascading renders. Reduced motion now reads through useSyncExternalStore, which is SSR-safe and responds to preference changes live.

Full changelog: v0.5.0...v0.6.0