build(deps): bump dependencies

[andreakiro]

Applies the outstanding dependency updates together, so the resulting combination is built and tested once rather than merged one at a time.

Root

• steel-sdk 0.14.0 to 0.18.0
• @onkernel/sdk 0.76.0 to 0.81.0
• dotenv 17.2.3 to 17.4.2
• tsx 4.20.6 to 4.23.1 (dev)

Web

• next 16.2.6 to 16.2.11
• recharts 2.15.4 to 3.10.0 (major)
• radix-ui 1.6.2 to 1.6.5
• tailwind-merge 3.5.0 to 3.6.0
• shadcn 3.8.5 to 4.14.0 (dev)
• postcss override 8.5.14 to 8.5.26

CI

• actions/checkout v7.0.0 to v7.0.1 in both workflows

Notes

The web audit job was already failing on main before this branch, on advisories published since the last dependency update (postcss, nanoid, js-yaml, ip-address, fast-uri, sharp). Clearing it is part of this change: npm audit fix at the lockfile level, plus raising the existing postcss override, which exists for exactly this purpose. Both projects now report 0 vulnerabilities.

next resolves to 16.3.3 rather than 16.2.11. This is deliberate: 16.2.11 still inherits two high severity libvips advisories through sharp and does not pass the audit job, while 16.3.3 does.

recharts 3 needed a code change. components/ui/chart.tsx is a vendored shadcn component and did not compile against the new type API, since Tooltip and Legend now read payload, label and verticalAlign from chart context instead of props. The fix realigns it with the types recharts 3 exports, matching upstream shadcn's own recharts 3 version. Two behaviour changes in recharts 3 are also handled there:

• Legend gained an itemSorter prop defaulting to alphabetical sorting. That reordered both legends, so the provider legend no longer matched the leaderboard ranking and the phase legend no longer matched the order the bars are stacked in. Legend items are now sorted back into chart config order.
• accessibilityLayer now defaults to on, which makes each chart keyboard focusable. The existing styles suppressed the outline, so this added two tab stops with no visible focus indicator. Charts now show a focus ring on keyboard focus only.

Verified by building and serving both this branch and main and comparing them: every route returns the same status, the leaderboard and benchmark API responses are byte identical, the security headers are unchanged, and the charts render the same series, colours, values and bar stacking. The only rendered difference is one additional y axis label that recharts 2 suppressed for spacing.

Supersedes #34, #35, #37, #38, #39, #40, #41, #42, #43, #44.

Left out: #36 (@browserbasehq/sdk 2.6.0 to 2.16.0). Between those versions the SDK switched its default HTTP transport from node-fetch with a keep alive agent to the platform fetch, and stopped attaching an agent at all. The old agent dropped idle sockets after 4 seconds, which is shorter than the gap between benchmark runs, so Browserbase runs currently pay a fresh TLS handshake inside the window measured as session_creation_ms. On the new transport that socket is reused. That would lower Browserbase's published latency for reasons unrelated to the service being measured, so it is a benchmark methodology decision rather than a dependency one and is better made deliberately. #36 is left open.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
browser-arena	Ready	Preview	Aug 28, 2026 5:36pm

[greptile-apps]

Greptile Summary

The PR updates root, web, and CI dependencies and adapts the shared chart component to Recharts 3.

• Updates provider SDKs and root development tooling.
• Updates Next.js, Recharts, Radix UI, Tailwind-related packages, and shadcn.
• Restores chart legend ordering and visible keyboard focus styling.
• Advances pinned and tagged actions/checkout references.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
web/components/ui/chart.tsx	Migrates shared tooltip and legend content to Recharts 3 types, restores config-defined legend ordering, and adds visible keyboard focus styling.
web/package.json	Updates the web framework, charting and UI dependencies, development tooling, and the PostCSS override.
package.json	Updates provider SDKs, dotenv, and the tsx development runner.
.github/workflows/ci.yml	Advances the checkout action used by both build jobs.
.github/workflows/secrets.yml	Advances the commit-pinned checkout action used by secret scanning.

_{Reviews (2): Last reviewed commit: "fix(web): adapt chart components to rech..." | Re-trigger Greptile}

[andreakiro]

On the regression test finding: valid in principle, but not something this PR should carry.

This repository has no test framework. CI runs install, build and npm audit for the root and web projects, and a secret scan. There is no runner, no config and no test directory, so "add coverage for this change" means introducing a test stack and a new CI job. That is a reasonable thing to do, but it is a separate decision about the project's tooling rather than part of applying pending dependency updates, and it should be reviewable on its own rather than inside a lockfile bump.

The two behaviours were verified by building and serving both this branch and main and comparing them directly, rather than by inspection:

• Route parity across all 15 routes: identical status codes, and the leaderboard and benchmark API responses are byte identical. Response headers, including the CSP, are unchanged.
• Rendered output compared at the pixel level. Series count, colours, line geometry, bar heights and bar stacking order are the same. The only difference is one extra y axis label that recharts 2 suppressed for spacing.
• Legend ordering read from the live DOM after the chart animation settles, on both versions. Before the fix recharts 3 produced alphabetical order; after it, the order matches main exactly, and the phase legend again matches the bottom to top order the bars are stacked in.
• Keyboard focus checked in a browser: with accessibilityLayer now defaulting to on, both chart surfaces are focusable, and the focus ring resolves to a visible 2px outline under :focus-visible and to no outline otherwise. This was worth checking carefully, since outline-hidden sets the shared outline style variable and a width and colour alone still computed to outline-style: none.
• Both CI jobs were reproduced locally from a clean npm ci on Node 26, matching the version the workflows and the Dockerfile use, along with the Dockerfile build steps and the secret scan.

Worth noting for context: the web audit job was already failing on main before this branch, so this PR moves that job from red to green.

[andreakiro]

@greptile review