chore: weekly maintenance — dep bumps

[arzafran]

What this does

Routine weekly dependency maintenance. Bumped devDependencies and internal-tooling/example-app dependencies to the latest version already permitted (or safely tightened) by each package's semver range (patch/minor only). No source code, public API, or CI config changes.

Bumped:

• Root (lenis) devDependencies: @biomejs/biome 2.4.7 → 2.5.5, tsdown 0.21.4 → 0.21.10 (declared range ^0.21.4 → ^0.21.10 to match), typescript 5.7.3 → 5.9.3 (declared range tightened to match resolved version; already the latest permitted 5.x)
• packages/react devDependencies: react 19.0.0 → 19.2.8, @types/react 19.0.7 → 19.2.17
• packages/vue devDependencies: vue 3.5.13 → 3.5.40
• playground (example app, unpublished): @astrojs/check, @astrojs/react, @astrojs/vue, @types/react/@types/react-dom, astro, lorem-ipsum, react, react-dom, vue — all patch/minor bumps within existing ranges
• playground/nuxt (example app, unpublished): nuxt 3.15.3 → 3.21.9

Explicitly left untouched:

• peerDependencies in root package.json (react, vue, @nuxt/kit) — these are inherited by downstream consumers and are reported below only, never bumped by this sweep. As last week, plain bun update at the root rewrote these ranges (e.g. react: ">=17.0.0" → "^19.2.4"), which would have silently dropped support for React 17/18 users — reverted before committing.
• The "lenis": "*" self-references in playground/playground/nuxt — bun update tried to pin these to ^1.3.25, not a real external dependency bump, so reverted.

Verified:

• Clean bun install + bun run build (root) pass with the bumped lockfile.
• Confirmed playground's own astro check && astro build fails identically on unmodified main (5 pre-existing TS errors, e.g. defineNuxtConfig/defineNuxtPlugin not found, stats-js missing types) — not caused by this sweep, left as-is per scope (no source changes).

Findings (not acted on)

Major versions available (report only):

• typescript 5.9.3 → 7.0.2 (root, playground)
• tsdown 0.21.10 → 0.22.13
• nuxt 3.21.9 → 4.5.0
• astro 5.18.2 → 7.1.3
• @astrojs/react 4.4.2 → 6.0.1
• @astrojs/vue 5.1.4 → 7.0.1
• lorem-ipsum 2.0.10 → 3.0.0
• vue-router (playground/nuxt) 5.0.3 → 5.2.0
• gsap (playground/nuxt) 3.14.2 → 3.15.0

Runtime/peer dependency updates available (never bumped by this sweep — downstream users inherit these ranges):

• react → 19.2.8 available (range: >=17.0.0)
• vue → 3.5.40 available (range: >=3.0.0)
• @nuxt/kit → 4.5.0 available (range: >=3.0.0, unbounded — worth adding an upper bound if Nuxt 4 support hasn't been verified)

CI observations:

• Still no .github/workflows/ directory — no CI pipeline runs tests/lint/build on PRs or pushes.
• .github/dependabot.yml still only configures the github-actions ecosystem (a no-op with no workflow files), with no config for the npm/bun ecosystem.
• No test, lint, or typecheck scripts in the root package.json; only build was run/verified by this sweep.
• On push, GitHub now reports 9 Dependabot vulnerability alerts on main (3 high, 4 moderate, 2 low) — up from 6 last week (3 high, 2 moderate, 1 low). Not addressed here (outside sweep scope/tooling); see the repo's Security → Dependabot alerts tab.

Not merging — leaving for review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lenis-playground	Ready	Preview, Comment	Jul 23, 2026 10:17am

[arzafran]

refreshed by this week's sweep — rebased onto latest main (v1.3.25 + README sponsors update); same set of packages had new patch/minor releases (biome 2.5.4→2.5.5, react 19.2.4→19.2.8, nuxt 3.21.2→3.21.9, astro 5.18.1→5.18.2, etc.); Dependabot alert count on main rose from 6 to 9 (3 high, 4 moderate, 2 low) — still unaddressed, out of sweep scope.

---

Generated by Claude Code