chore(deps): bump the web production group

[PunGrumpy]

Background

Dependabot opened #19 for this group before the repository tracked a text lockfile, so its branch could not be updated with bun.lock, and it was closed while I rebased it. This carries the same eight bumps on a branch with the lockfile regenerated.

Summary

• next 16.3.4 to 16.3.5, react and react-dom 19.2.8 to 19.3.0, with @types/react and @types/react-dom 19.3.0.
• fumadocs-core and fumadocs-ui 16.15.8 to 16.15.10.
• vgpu and @vgpu/wgsl 0.4.1 to 0.5.0, and cn 0.2.6 to 0.3.0.
• bun.lock regenerated for the above.

Verification

bun install --frozen-lockfile reports no changes. CI runs typecheck, tests, lint, and build; the Vercel preview builds the docs site, which is where the React, Next, and vgpu bumps matter.

Checklist

• Tests have been added or updated. Not needed, dependency bumps only.
• Documentation has been added or updated. Not needed.
• A changeset has been added for vecstore-sdk. Not needed, nothing in the package changes.
• I have reviewed this pull request myself

Summary by CodeRabbit

• Chores
  • Updated web application dependencies, including the framework, UI libraries, React packages, and graphics tooling.
  • Applied compatible patch and minor version updates to improve platform currency and maintainability.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
vecstore-sdk	Ready	Preview	Sep 18, 2026 6:36pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 5340972c-0b06-4c47-944c-08b64f3ff821

📥 Commits

Reviewing files that changed from the base of the PR and between 2cc7631 and dad7b24.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• apps/web/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (1)

apps/web/package.json (1)

14-24: LGTM!

Also applies to: 30-31

---

📝 Walkthrough

Walkthrough

The web package updates several runtime dependencies and React type packages. The changes include newer versions of @vgpu/wgsl, vgpu, cn, Fumadocs, Next.js, React, and related type packages.

Changes

Web dependency updates

Layer / File(s)	Summary
Update web dependency versions apps/web/package.json	Updated selected runtime dependencies and React type packages. Unchanged dependencies retain their existing versions.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to dad7b

No actionable merge-blocking issue is established by the dependency updates.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies a dependency update for the web production group and matches the main changes.
Description check	✅ Passed	The description includes the required Background, Summary, Verification, and Checklist sections. It explains the dependency updates, lockfile regeneration, verification command, and why tests, documen…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the package tree
New versions hop from key to key
React and types now match in line
The web app gets a fresher sign
Dependencies rest, tidy and free}

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: dad7b24

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.3.4 ⏵ 16.3.5			+1
	@​types/​react-dom@​19.2.7 ⏵ 19.3.0
	fumadocs-core@​16.15.8 ⏵ 16.15.10			+1
	fumadocs-ui@​16.15.8 ⏵ 16.15.10
	@​types/​react@​19.2.18 ⏵ 19.3.0
	react@​19.2.8 ⏵ 19.3.0	+1		+1
	cn@​0.3.0
	react-dom@​19.2.8 ⏵ 19.3.0			+1
	vgpu@​0.4.1 ⏵ 0.5.0	+1		+1	+1
	@​vgpu/​wgsl@​0.4.1 ⏵ 0.5.0	+1		+1	+1

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/vecstore-sdk@31

commit: dad7b24

[baymiai]

Security review: nothing to raise.

Read the eight dependency bumps, their lockfile, and the peer dependency updates in @vgpu/wgsl.