build(deps): refresh Vite and Lucide

[dependabot]

Update the preview toolchain to Vite 8.3.3 and Lucide 1.53.0. Vite includes HTML transformation and development-server access fixes; Lucide is the newest icon release outside the repository's 48-hour maturity window at validation time. The manifest and lockfile agree, and both published integrity hashes were verified against the npm registry.

This extends Dependabot's original Vite update with the eligible Lucide update and an Unreleased changelog entry. Newer Vite and Lucide releases remain inside the cooldown. Package version, exported design contracts, and supported Bun minimum are unchanged.

Validation on a clean Linux AWS Crabbox:

• Bun 1.4.2: frozen install, bun run check — 244 tests passed, contract/skill/package checks passed.
• Bun 1.3.0: frozen install, bun run check — 244 tests passed, contract/skill/package checks passed.
• bun run preview:build passed; the existing chunk-size advisory remains non-fatal.
• bun run preview:dev HTTP smoke passed for the root, a deep link, a query-string deep link, the preview module, and the Lucide module; the test server was stopped afterward.
• Codex autoreview at the repository's P0–P3 threshold: clean.

Thanks @dependabot[bot].

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates the preview’s Vite dependency to 8.3.3 and Lucide to 1.53.0, synchronizes the lockfile, and adds a changelog entry.

Example: A developer installs dependencies to serve the Carapace preview.

• Before: Main installs Vite 8.3.2 and Lucide 1.52.0.
• After: This PR installs Vite 8.3.3 and Lucide 1.53.0.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and has passing validation; inspectable behavior evidence is limited to the existing harness, with shipped-command results reported in prose.
Proof confidence	🦐 gold shrimp (3/6)	This bot-authored dependency PR is outside the ordinary contributor proof gate; passing CI exercises Vite builds and Lucide imports, while the body reports a Linux preview build and HTTP smoke without attached runtime output.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The design preview remains on older bundler and icon releases, including a bundler version preceding upstream HTML and development-server fixes.
Reason: The update follows established maintenance direction and has a small, coherent scope without new options or public contracts.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it provides a focused dependency refresh that current main does not contain, with matching registry integrity hashes and passing validation checks on the reviewed head.

Priority: P3
Reviewed head: f45935ef416bd77eb20ec74ac372448356353d93

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The reported development-server smoke has no attached response trace or browser evidence to inspect.

Agent review details

How this fits together

The preview toolchain takes Carapace’s HTML, JavaScript, CSS, and icon imports and produces a local development site or static preview assets.

flowchart LR
  A[Preview source] --> C[Vite configuration]
  B[Pinned dependencies] --> C
  B --> D[Lucide icon imports]
  D --> C
  C --> E[Development site]
  C --> F[Static preview assets]

Loading

Technical review

Best possible solution:

Land the matching dependency pins and lockfile through the existing maturity and validation policy.

Do we have a high-confidence way to reproduce the issue?

This PR refreshes dependencies rather than reporting a reproducible Carapace defect.

Is this the best way to solve the issue?

Updating the existing exact pins and matching lockfile is a narrow solution consistent with prior merged refreshes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b70be5862a1e.

Provenance checked

• Vite and Lucide dependency pins keeps the original intent (b70be58: build(deps): refresh terminal preview, icons, and Vite #92 refreshed mature preview dependencies while retaining public contracts, Bun compatibility, and the 48-hour policy.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Introduced change: The verified introduction diff changes two existing dependency pins, their lockfile records and integrity hashes, and one Unreleased entry; scripts, exports, package version, and Bun requirements remain unchanged. (package.json:57, f45935ef416b)
• Still necessary: GitHub’s default branch remains at the fetched main revision, whose manifest pins Vite 8.3.2 and Lucide 1.52.0; repository search for 8.3.3 returns only this PR. (package.json:61, b70be5862a1e)
• Registry and maturity verification: The published metadata at https://registry.npmjs.org/vite/8.3.3 and https://registry.npmjs.org/lucide/1.53.0 matches both changed integrity hashes. Publication times are October 6 at 04:10 UTC and October 8 at 06:27 UTC, respectively, both more than 48 hours before the final update. Neither package declares an installation lifecycle hook. (bun.lock:88, f45935ef416b)
• Established maintenance direction: The merged refreshes build(deps): refresh terminal preview, icons, and Vite #92 and build(deps): refresh preview dependencies and CodeQL #89 establish the same bounded dependency maintenance approach, preserving public contracts and the maturity window. (CHANGELOG.md:10, b70be5862a1e)
• Reviewed-head checks: The pinned-Bun and minimum-Bun checks, CodeQL, both analysis checks, and a dispatch check pass on the reviewed head. A separate dispatch was cancelled; there is no failing validation check to attribute to the patch. (.github/workflows/ci.yml:29, f45935ef416b)
• Validation scope: Existing tests invoke Vite’s real build API and import the curated Lucide registry. The current PR body additionally reports a successful production build and development-server HTTP smoke covering root, deep links, query strings, and preview and Lucide modules. (tests/preview-build.test.ts:181, f45935ef416b)

Likely related people:

• Patrick Erichsen: Raw commit 8f9548f adds package.json:35 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 8f9548f15c1f; files: package.json)

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is routine preview dependency maintenance without an established urgent Carapace regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

History

Review history (7 earlier review cycles)

• reviewed 2026-10-08T08:30:22.743Z sha d99a100 :: needs maintainer review before merge. :: none
• reviewed 2026-10-08T15:50:55.552Z sha d99a100 :: needs maintainer review before merge. :: none
• reviewed 2026-10-08T17:28:43.702Z sha d99a100 :: needs maintainer review before merge. :: none
• reviewed 2026-10-08T22:30:30.332Z sha d99a100 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T03:08:14.854Z sha d99a100 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T08:28:51.653Z sha d99a100 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T13:35:44.927Z sha d99a100 :: needs maintainer review before merge. :: none

Reviewed October 10, 2026, 5:44 AM ET / 09:44 UTC (Revision 8).