chore(deps): Bump the frontend group, correcting two broken upstreams

[OffCrazyFreak]

Supersedes #122.

Same 30-package group bump Dependabot proposed, with two packages corrected. #122 dies at pnpm install --frozen-lockfile on pnpm's minimumReleaseAge gate, and that failure hides two real build failures sitting behind it. Neither is visible until you get past the install, which CI never does.

Commit fad37de is Dependabot's original, unmodified. Everything after it is the correction, so the review diff is three lines in package.json, one ignore rule, and the lockfile.

react-scan 0.5.7, held at ^0.4.3

Can't import the named export 'version' (imported as 'REACT_GRAB_VERSION')
from default-exporting module (only default export is available)
  ./node_modules/.../react-scan/dist/index.mjs
  ./src/app/providers/react-scan.tsx

react-scan 0.5.6 and later ship a published bundle containing this line, at dist/index.mjs:18729 and dist/core/all-environments.mjs:18729:

import { version as REACT_GRAB_VERSION } from "react-grab/package.json";

Webpack treats JSON modules as default-exporting only, so the named version binding cannot be linked and the compile fails. Reported upstream as aidenybai/react-scan#467 (which has a validated patch attached already) and aidenybai/react-scan#447, both still open. 0.5.7 is still latest, so there is no fixed release to move to. The floating-tag problem below is filed separately as aidenybai/react-scan#468.

0.5.5 predates the bad import and would build, but it would need an exact pin, since ^0.5.5 resolves straight back up to 0.5.7. It also does not solve the second problem: every 0.5.x release declares "react-grab": "latest", and 0.5.7 adds "react-doctor": "latest" alongside it. Floating tags mean a fresh resolution can pull a version nobody reviewed. 0.4.3 has no floating dependencies, so the caret stays on 0.4.x.

A bounded ignore rule went into .github/dependabot.yml so this does not get re-proposed every month, matching the existing springdoc entry in that file. 0.4.x patches still come through. Note the caret alone already excludes 0.5.x; the rule only stops the range being proposed for raising again.

Side effect: this also drops @opentelemetry, react-doctor and react-grab from the lockfile, which accounts for most of the deletions in the diff.

@radix-ui/react-slot 1.3.2, raised to ^1.3.3

Error: Slot failed to slot onto its children. Expected a single React element child or `Slottable`.
Export encountered an error on /_not-found/page, exiting the build.

Instrumenting Slot to dump its children shows five, with the middle one carrying $$typeof: Symbol(react.lazy) and no __radixId. components/ui/button.tsx is not a client component, so importing Slottable from a "use client" radix module gives it a client reference, which serialises into the children array as a lazy element.

1.3.2 unwraps lazy children in two places, a lazy children value and a lazy child inside a Slottable, but not while walking a children array. So isSlottable returns false for every child and it throws where 1.3.0 silently tolerated it.

Radix shipped the fix the same evening: @radix-ui/react-slot 1.3.3 and radix-ui 1.6.7 at 2026-07-24T23:51Z, against the broken 1.3.2 and 1.6.6 at 16:28Z. So this moves forward instead of pinning back, and needs no override and no edit to components/ui/.

Verification

Ran locally against the corrected set, reproducing the CI frontend job step for step:

step	result
pnpm install --frozen-lockfile	ok
next typegen	ok
tsc --noEmit	clean
eslint src	0 errors, 20 pre-existing warnings
prettier --check src	clean
next build --webpack	compiled, 37/37 static pages

The install used --config.minimumReleaseAge=0 as a one-off command line flag. No .npmrc, pnpm-workspace.yaml or minimumReleaseAgeExclude change was made, so the supply chain policy is exactly as it was.

Expected CI state until tonight

The newest entries in this lockfile are the radix 1.6.7 batch published 2026-07-24T23:51Z. pnpm's 24h gate clears them at 2026-07-25T23:51Z. Until then this PR fails at the install step with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on 95 entries, same as #122 did. The first run on this branch confirmed the shape: Backend checks passed, Frontend failed on the gate alone, with no step after the install even executing. Re-run the checks after that time and merge.

[netlify]

❌ Deploy Preview for disscount failed. Why did it fail? →

Name	Link
🔨 Latest commit	b47b5e0
🔍 Latest deploy log	https://app.netlify.com/projects/disscount/deploys/6a645953289f740008d113c5

[coderabbitai]

Walkthrough

Frontend dependency versions are updated across runtime and development packages. Dependabot is configured to ignore react-scan versions >=0.5.0 for frontend updates.

Changes

Frontend dependency maintenance

Layer / File(s)	Summary
Frontend dependency version updates frontend/package.json	Updates Radix, Sentry, Serwist, TanStack, form, email, resend, generator, browser-mapping, Prettier, and Serwist versions while retaining React 19.2.8.
react-scan update policy .github/dependabot.yml	Adds a frontend npm ignore rule for react-scan versions >=0.5.0 with an explanatory webpack compatibility comment.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit hops through versions bright,
With tidy packages set just right.
Dependabot rests by the scan,
While webpack follows its careful plan.
Fresh tools bloom in the moonlit light.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the frontend dependency bump and the upstream fixes, matching the main changeset.
Description check	✅ Passed	The description directly explains the dependency updates, broken upstreams, and verification, so it matches the PR changes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}