deps: consolidated dependency upgrades (supersedes #52, #53, #54, #56)

[andreibesleaga]

What changed and why

Consolidates the four open bot PRs into one verified upgrade. All four were failing CI (#53/#54/#56 with npm ci lockfile-sync errors, #52 on the Board UI job), so the upgrades were re-applied from main with properly regenerated lockfiles and each major tested individually.

Root — production deps (supersedes #54)

• @a2a-js/sdk 0.3.13 → 0.3.14
• @langchain/openai 0.5.18 → 1.5.5 (major) + @langchain/core → 1.2.3 in lockfile. The tree already resolved core 1.x via overrides (kaibanjs transitively uses @langchain/openai 1.4.7), so this aligns the direct dep with the tree instead of splitting it.
• OpenTelemetry: exporters + sdk-node 0.219.0 → 0.220.0, auto-instrumentations-node 0.77 → 0.78, sdk-metrics 2.8 → 2.9
• bullmq 5.79.0 → 5.80.5, helmet 8.2.0 → 8.3.0

Root — dev deps (supersedes #53)

• @types/node 26, @vitest/coverage-v8 + vitest 4.1.10, eslint 10.7.0, fast-check 4.9.0, prettier 3.9.5, typescript-eslint 8.64.0
• TypeScript 7.0.2 NOT adopted: TS 7 removes moduleResolution: node10 and baseUrl (errors TS5108/TS5102 against our tsconfig). Adopting it is a module-resolution migration, not a dependency bump. Staying on 6.0.3 (latest 6.x).

Snyk fix (supersedes #56)

• SNYK-JS-OPENTELEMETRYPROPAGATORJAEGER-17901201 (high) resolved by the otel 0.220 bump — npm audit --audit-level=high reports 0 vulnerabilities. [Snyk] Fix for 1 vulnerabilities #56 itself shipped a half-updated lockfile, which is why its CI failed.

Board (supersedes #52)

• react/react-dom 18.3.1 → 19.2.7, @types/react(-dom) 19.x — board already uses createRoot; no code changes needed
• zustand 4.5.7 → 5.0.14 — board uses the named create import; no code changes needed
• tailwindcss 3.4 → 4.3.2 with the CSS-first migration: @tailwindcss/postcss plugin, @import 'tailwindcss', tailwind.config.js removed (its custom surface colors and pulse-slow animation were unused), autoprefixer dropped (built into v4), backdrop-blur-sm → backdrop-blur-xs (v4 scale rename, same 4px)
• typescript 5.9.3 → 6.0.3, vite 8.1.4, vitest 4.1.10, @playwright/test 1.61.1, @vitejs/plugin-react 6.0.3, happy-dom 20.10.6, postcss 8.5.19

Test coverage

• Root: lint (0 warnings) · typecheck · madge (no cycles) · api-extractor (no drift) · 1155 tests / 108 files, 100% coverage (statements/branches/functions/lines)
• Board: typecheck · vite build · 148 tests / 14 files (Testing Library + vitest-axe)
• npm ci lockfile sync verified for both root and board (the exact failure mode of the superseded PRs)

Breaking changes

None to the public API (api-extractor reports no drift). Board visual note: Tailwind 4 preflight may shift minor default styles; borders all carry explicit colors and no renamed utilities were in use, so impact should be nil — worth a quick eyeball of the board and a test:visual baseline refresh if diffs appear.

Security implications

Positive: fixes the high-severity jaeger-propagator advisory; audit clean at high level.

Closes #52, closes #53, closes #54, closes #56.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR consolidates multiple dependency-bump PRs into a single, lockfile-synced upgrade across the root package and the /board app, including major upgrades (React 19, Tailwind 4, Zustand 5) and OpenTelemetry updates.

Changes:

• Upgrades root production + dev dependencies (notably @langchain/openai 1.x, OpenTelemetry 0.220, lint/test toolchain updates).
• Migrates the board app to Tailwind 4’s CSS-first setup (PostCSS plugin + @import 'tailwindcss') and removes the unused Tailwind config.
• Updates board framework dependencies (React 19 / Zustand 5) and adjusts one Tailwind utility rename (backdrop-blur-sm → backdrop-blur-xs).

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
package.json	Root dependency and devDependency upgrades (LangChain/OpenTelemetry/tooling versions).
board/tailwind.config.js	Removes Tailwind v3 config as part of Tailwind v4 CSS-first migration.
board/src/index.css	Switches to Tailwind v4 CSS import (@import 'tailwindcss').
board/src/components/layout/Header.tsx	Updates a renamed Tailwind utility class for v4 blur scale.
board/postcss.config.js	Switches PostCSS plugin from tailwindcss/autoprefixer to @tailwindcss/postcss.
board/package.json	Board dependency upgrades (React/Zustand/Vite/Vitest/Tailwind 4 + new @tailwindcss/postcss).
board/package-lock.json	Lockfile regenerated for board dependency tree changes.

Files not reviewed (1)

• board/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.