[atomantic]

Summary

• Update the client to Vite 8.3.8 (patch) and Lucide React 1.72.0 (minor), regenerate the npm lockfile, and add the changelog entry.
• Review upstream Vite release notes and Lucide release notes. The Route icon adopts the upstream orientation; existing imports and Vite configuration remain compatible.
• Inventory all open Dependabot alerts (zero) and use the supplied empty PR inventory, with fresh overlap checks for both updates. Check all 43 direct external packages against npm; no further updates remain.

Test plan

• npm ci --no-audit --no-fund
• npm run check:file-sizes and git diff --check
• npm run build (all three workspaces)
• npm run test:unit — 248 tests passed
• npm test --workspace client -- --run — 15 tests passed
• Supported server startup plus Chromium UI smoke check — healthy API, HTTP 200, rendered UI, no page errors; JSON read-only fallback with no configured database
• Full and production-only npm audits — zero vulnerabilities
• Root and all-workspace npm outdated checks — empty
• All seven GitHub Actions references match their latest upstream release commits; OSV queries for those resolved versions returned zero advisories
• Hosted CI: Build, Unit Tests, Integration Tests, and Scraper Tests passed on 27b017280a52594598eb46a348f2a6abc6c53999

Validation ran UNCONTAINED in the private worktree: the required containment probe exited 2 with contained-run refused (disabled): Docker containment is off; nothing ran during that probe.

Coverage: the Python legacy exporter uses only the standard library; no third-party Python pins or manifests were found. The CI-only postgres:17 service in .github/workflows/ci.yml has no image/SBOM scan evidence, so its OS packages remain an explicit coverage gap owned by SparseTree CI maintainers.