[github-actions]

Weekly update of every dependency with a compatible release, one group at a time. Native helpers whose pins changed were rebuilt on the Mac runner. A group that failed to install or build, even after Claude's attempt, is left out and listed below.

Mac checks: failed. CI adds the unit tests on Linux, the Codex regression tests and the visual comparison with main.

Groups

Group	Result
npm packages, device runtimes and GitHub Actions	✅ applied
sentry-native	✅ applied
Baguette	↩️ left out: installing or building still failed after Claude's changes
libimobiledevice	✅ applied
iPhone mirror Rust crates	✅ applied

Applied

Dependency	From	To
npm: @base-ui/react	1.8.0	1.9.0
npm: @legendapp/list	3.6.0	3.7.1
npm: @modelcontextprotocol/sdk	1.31.0	1.32.2
npm: @rozenite/ui	2.4.0	2.5.0
npm: @sentry/node	11.2.0	11.10.0
npm: @sentry/react	11.2.0	11.10.0
npm: lucide-react	1.49.0	1.66.0
npm: radix-ui	1.6.7	1.8.1
npm: react	19.3.0	19.3.1
npm: react-dom	19.3.0	19.3.1
npm: react-resizable-panels	4.14.1	4.16.1
npm: undici	8.12.1	8.12.3
npm: ws	8.22.0	8.22.1
npm: zod	4.3.6	4.6.7
npm: @commitlint/cli	21.2.3	21.2.4
npm: @commitlint/config-conventional	21.2.3	21.2.4
npm: @types/node	22.20.4	22.20.5
npm: shadcn	4.21.0	4.23.0
npm: vite	7.3.6	7.3.7
serve-emu runtime: @fastify/busboy	3.2.0	3.2.4
serve-emu runtime: ws	8.22.0	8.22.1
Native: sentry-native	0.17.1	0.17.5
Native: libimobiledevice-glue	1.3.2	1.3.3

Also updated 31 Rust crates of the iPhone mirror within their ranges (see Cargo.lock).

Held back

Dependency	Current	Available	Why not applied
npm: @callstack/tracesift-explore	0.5.0	0.6.0	breaking version; update by hand
npm: @modelcontextprotocol/ext-apps	1.7.5	2.1.0	breaking version; update by hand
npm: @openai/mcp-extensions	0.1.0	0.2.1	breaking version; update by hand
npm: @sentry/cli	2.58.6	3.8.2	breaking version; update by hand
npm: @types/node	22.20.5	26.6.6	breaking version; update by hand
npm: @vitejs/plugin-react	5.2.0	6.2.1	breaking version; update by hand
npm: jsdom	29.1.1	30.1.3	breaking version; update by hand
npm: typescript	5.9.3	7.0.2	breaking version; update by hand
npm: vite	7.3.7	8.3.5	breaking version; update by hand
agent-device runtime: agent-device	0.21.33	0.21.35	manual pin: upstream #3995 breaks iOS input with a stale Xcode selection link
GitHub Actions: actions/setup-node	v7 (8207627)	v7.1.0	workflow files need a token with workflow permission
GitHub Actions: actions/upload-artifact	v7 (043fb46)	v7.0.2	workflow files need a token with workflow permission
GitHub Actions: actions/download-artifact	v7	v8	breaking version; update by hand
Native: Baguette	0.2.1	v0.2.12	left out this week: installing or building still failed after Claude's changes; see the run logs
Forks and vendored sources: serve-emu	0.0.6	0.1.0	our fork; merge upstream changes by hand
Forks and vendored sources: scrcpy server	4.0	v5.0.1	follows serve-emu
Forks and vendored sources: Perfetto SDK	v25.0	v59.1	vendored source; update by hand
Forks and vendored sources: idevice	a64b886	33 commits newer	unreleased Git pin; update by hand
Forks and vendored sources: device-hub-ios	1fcdfb0	28 commits newer	unreleased Git pin; update by hand

Checks on macOS

Check	Result
Unit tests	✅ passed (83s)
Telemetry types	✅ passed (2s)
Build	✅ passed (7s)
Package	✅ passed (6s)
Packaged server starts Baguette	✅ passed (10s)
Claude packages	✅ passed (20s)
Simulator stream and Baguette restart	❌ failed (108s)
Codex host regression	✅ passed (171s)

Logs: workflow run. Check physical-iPhone features (mirroring, logs) on a device before merging when their native pins changed.