[Deps] chore(deps): refresh MCP, rendering, framework and CSS dependencies

[pascal]

Changes

Continue the existing 28-file dependency batch at head 302d1ef. On October 15 it is ten commits ahead of main and zero behind.

• MCP SDK ^1.32.1 in CLI and MCP.
• Next.js 16.4.2 across apps, the root override and the Next ESLint plugin; React and React DOM 19.3.1; R3F 9.8.2 with the vendored pointer-event version and differential test aligned.
• Three.js 0.186.1 with the existing WebGPU patch refreshed; Drei ^10.7.9 and XR ^6.6.32.
• Tailwind ^4.3.3 with matching native oxide packages and PostCSS ^8.5.30.
• three-mesh-bvh ~0.9.16 in editor and viewer. Migrate internal maxLeafSize options to targetLeafSize while retaining SceneBvh's public prop. Patch three-bvh-csg 0.0.18 source, ESM and CJS distributions for that option migration.
• @pascal-app/lingo ^0.5.0 in core, editor and MCP, with scientific-dimension and ambiguous-range regression tests; motion ^14.3.0 in editor.
• CSS compilation, WebGPU material disposal and exported BVH ray-query regression coverage.

The current diff preserves concurrent standalone-app work. No permissions or schema changes appear in the observed diff. Rendering and behavioral acceptance are not established by CI alone.

Sources

MCP SDK 1.32.0 restricts HTTP redirects to the same origin and isolates in-memory tasks by session. Input-limit and expected-resource options remain opt-in; this branch does not enable them. 1.32.1 contains documentation/version changes.

Tailwind changelog and PostCSS changelog. These retained worker references are source evidence, not proof of manager research or deployed acceptance.

Validation

The manager observed all four GitHub checks passing on exact head 302d1ef on October 15: quality completed at 22:26:46 UTC, cli-smoke at 22:24:35 UTC, ci at 22:21:41 UTC, and Changed paths at 22:21:24 UTC. Runs: 38816514481 and 38816514482. This is observed CI, not manager-local execution. Repository-native acceptance is bun run ci (check, skills:validate, check-types, test and build), plus packed CLI/runtime smoke.

Earlier head 778b8ae failed quality in the reference-inventory test on concurrently added embed-page robots metadata; Build was skipped. That historical failure is not the current head's outcome. No embed-page or inventory-scanner repair appears in the current diff.

Protected review and acceptance

The October 14 guarded attempt on prior head 943cc1a required product/visual review for first-person-controls.tsx, first-person/build-collider-world.ts, glb-walkthrough-controller.tsx and scene-bvh.tsx, plus product review for patches/three-bvh-csg@0.0.18.patch as a new production surface. A fresh guarded review was requested for current head 302d1ef on October 15; its outcome is recorded separately in Fleet.

Keep this PR draft unless the guarded workflow independently approves and marks it ready. Green CI is not approval or a merge receipt. Browser/WebGPU rendering, released package consumption and deployment remain unverified. No screenshots are claimed.

The manager could identify job 40b5b0cf-d031-46d3-b24f-4040a9fe6db8 and its partial result da482f6e-bc10-4a06-ad32-e5d559787bc9 through Fleet activity, but the available task-result reader refused the job as outside its role. This description therefore relies on the actual GitHub diff and checks, not an unread worker validation report.

Changes

Patch/minor dependency bundle. I merged main in at b625bc0, which includes #1001 and #1094. The conflicts were in the root package.json, apps/editor/package.json and bun.lock. The manifests keep main's plugin snapshots: Bath Space, Landscape, pool 1da7fb0, streetscape on pascalorg, and WebXR 9cd9045. They also keep main's removal of the old plugin-pool@483a080 patch. bun.lock was regenerated with bun 1.4.2, not hand-merged.

Package	Version	Notes
next, @next/eslint-plugin-next	16.4.2	Patch release; the root override is kept aligned
react, react-dom	19.3.1	Patch
@react-three/fiber	9.8.2	Vendored pointer-event version and differential test aligned
three	0.186.1	Existing WebGPU patch refreshed as three@0.186.1.patch
@react-three/drei / @react-three/xr	^10.7.9 / ^6.6.32	Patch
tailwindcss, @tailwindcss/postcss, oxide natives	^4.3.3 / 4.3.3	Changelog
postcss	^8.5.30	Patch
three-mesh-bvh	~0.9.16	Internal maxLeafSize options renamed to targetLeafSize; the SceneBvh prop is unchanged. three-bvh-csg@0.0.18 is patched for the same rename
@modelcontextprotocol/sdk	^1.32.1	1.32.0 limits HTTP redirects to the same origin and isolates in-memory tasks per session. The new opt-in limits are not enabled
motion	^14.3.0	Minor
@pascal-app/lingo	^0.5.0	Adds regression tests for scientific dimensions and ambiguous ranges
geist	^1.8.1	New. Font binary version metadata realigned; Geist Sans no longer maps ω to Ω (release)
lucide-react	^1.58.0	New. Adds the certificate icon and redraws the barrel and music icons; none of the redrawn icons are used here (release)
fake-indexeddb	^6.2.6	New (dev, core tests). Performance work and a fix for a leak of finished transactions

Majors are out of scope: TypeScript 7 and lightningcss 1.33.

Validation

Local results with bun 1.4.2:

• Passed: check, skills:validate, check-types, build, and bun install --frozen-lockfile.
• Same failures as main: local test fails one viewer, one editor and 22 nodes tests. Running origin/main in the same VM fails the identical set, so this branch adds no new failures. Main's GitHub CI is green.
• Viewer test cause: the viewer failure depends on test order. render-error.test.tsx restores globalThis.window as a present-but-undefined key. When that file runs before perf-monitor.test.tsx, as it does on this filesystem, perf-monitor.test.tsx fails. This PR leaves it unchanged; it's out of scope.

GitHub CI on the new head is the acceptance gate.

  

---

Note

Medium Risk
Touches 3D collision/CSG, patched Three and three-bvh-csg, and framework bumps across apps; behavior is mostly covered by tests but rendering and walkthrough still warrant manual review.

^{Reviewed by Cursor Bugbot for commit 2b8d452. Bugbot is set up for automated code reviews on this repo. Configure here.}