chore(deps): bulk Dependabot bumps — 5 npm (/ui) + 5 GitHub Actions

[SoundMindsAI]

Consolidates ten open Dependabot PRs into a single branch so they merge as one unit. Closes #370, #371, #372, #373, #374, #375, #376, #377, #378, #379. (#365 deliberately excluded — it's a human contributor's docs PR, not Dependabot.)

npm (/ui)

Package	From	To	Superseded PR
@tanstack/react-query	5.62.16	5.100.14	#377
react + react-dom	19.2.x	19.2.7	#378
@types/react	19.2.15	19.2.16	#378
eslint-config-next (dev)	16.2.6	16.2.7	#376
postcss (dev)	8.4.49	8.5.15	#379
vitest (dev)	4.1.7	4.1.8	#375

Note on react-dom: Dependabot's #378 bumped only react (to 19.2.7), leaving react-dom at 19.2.6. React enforces an exact version match between the two, so that bump alone failed to load all 135 vitest component files (Incompatible React versions). This PR bumps react-dom in lockstep — the correct way to land #378.

GitHub Actions

Action	From	To	Superseded PR
actions/setup-python	5	6	#374
actions/upload-pages-artifact	3	5	#370
actions/deploy-pages	4	5	#373
actions/upload-artifact	4	7	#372
github/codeql-action	3	4	#371

Verification

Local /ui gates all green after the bumps:

• pnpm typecheck — clean
• pnpm lint — 0 errors (pre-existing security-plugin warnings only)
• pnpm test — 998 tests across 135 files passing
• pnpm build — production build compiles + static-generates

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates several frontend dependencies in ui/package.json and updates the pnpm-lock.yaml file accordingly, notably bumping react and react-dom to ^19.2.7 and @tanstack/react-query to ~5.100.14. Feedback points out a version mismatch between @tanstack/react-query and @tanstack/react-query-devtools, which should be kept in sync to prevent potential runtime errors or unexpected behavior.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

There is a version mismatch between @tanstack/react-query (bumped to ~5.100.14) and @tanstack/react-query-devtools (left at ~5.62.16). These packages should be kept in sync to prevent potential runtime errors, incompatible types, or unexpected behavior.

[SoundMindsAI]

Gemini Code Assist adjudication

#	File:Line	Finding	Verdict	Action
1	ui/package.json:33 (medium)	@tanstack/react-query bumped to ~5.100.14 but @tanstack/react-query-devtools left at ~5.62.16 — should stay in sync	Accept	Bumped devtools to ~5.100.14 in commit 76c6d14b. typecheck + 998 tests + build re-verified green.

1 finding, accepted and fixed.

Note: the smoke (operator-path tutorial flow) check is red, but that's a pre-existing Solr-container startup flake in CI (same red on recently-merged #367 and #369) — unrelated to these dependency bumps. All gates that exercise the changes (frontend lint/typecheck/test/build, backend, static-checks, docker buildx, DCO, secrets) are green.