chore(gui): consolidate Dependabot updates and lockfile

[OnlineChef (ChefGroep)]

Summary

• consolidates chore(deps-dev): bump the minor-patch group in /gui with 2 updates #198, chore(deps-dev): update @types/react-dom requirement from ^19.2.5 to ^19.2.7 in /gui #199, chore(deps): update @designcodeio/threeui requirement from ^1.1.0 to ^1.2.0 in /gui #200, chore(deps-dev): update globals requirement from ^17.11.0 to ^17.12.0 in /gui #201 and chore(deps-dev): update @types/node requirement from ^26.4.0 to ^26.4.1 in /gui #202
• applies the six pending GUI dependency version updates in one manifest change
• regenerates gui/bun.lock with the CI-pinned Bun 1.3.14
• keeps the dependency campaign as one reviewable exact-SHA unit

Validation

• bun install --frozen-lockfile
• bun run typecheck
• bun run privacy:scan
• cd gui && bun run lint
• cd gui && bun run build
• cd gui && bun test tests --isolate — 456 passed, 0 failed

Supersedes #198, #199, #200, #201 and #202.

Summary by CodeRabbit

• Chores
  • Updated several development and UI package dependencies to newer compatible versions.
  • No user-facing functionality or application behavior was changed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 4ae8df0d-d148-4f69-800c-8904dc6f628f

📥 Commits

Reviewing files that changed from the base of the PR and between 1e07891 and d63aa41.

⛔ Files ignored due to path filters (1)

• gui/bun.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• gui/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The GUI package manifest updates six dependency versions. No scripts, package structure, or other dependency entries changed.

Changes

GUI dependency updates

Layer / File(s)	Summary
Update GUI dependency versions gui/package.json	Updates @designcodeio/threeui, @types/node, @types/react-dom, eslint-plugin-react-refresh, globals, and happy-dom to newer versions. Other listed dependencies remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to d63aa

This updates GUI runtime and development dependencies with a regenerated lockfile; the reported installation and GUI validation pass, with no remaining merge-blocking risk.

Suggested reviewers: wibias, lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the primary changes: consolidating GUI Dependabot dependency updates and regenerating the lockfile.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/gui-dependabot-lockfile-convergence

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	happy-dom@​20.12.0 ⏵ 20.14.0				+1
	@​types/​react-dom@​19.2.5 ⏵ 19.2.7	+1		+1
	@​types/​node@​26.4.0 ⏵ 26.5.0			+1
	globals@​17.11.0 ⏵ 17.12.0	+1		+1	-1
	@​designcodeio/​threeui@​1.1.0 ⏵ 1.2.0	+8		+2	+1
	eslint-plugin-react-refresh@​0.5.5 ⏵ 0.5.6	+1		+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm @designcodeio/threeui under OFL-1.1 License: OFL-1.1 - The applicable license policy does not permit this license (5) (package/THIRD_PARTY_NOTICES.md) License: OFL-1.1 - The applicable license policy does not permit this license (5) (package/ASSET-LICENSES.md) License: OFL-1.1 - The applicable license policy does not permit this license (5) (package/FONT-LICENSES.md) From: gui/package.json → npm/@designcodeio/threeui@1.2.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@designcodeio/threeui@1.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report