chore(code): upgrade Electron 42, React 19.2, Vite 7 and deps (#2817)

## Problem

We had fallen several majors behind on core dependencies (Electron 41, React 19.1, Vite 6) plus a long tail of libraries, missing performance, security and bug fixes. A previous attempt (#2512) predated the electron-builder and electron-vite migration and was closed, so this redoes the upgrade from first principles on top of that work.

## Changes

Dependency modernization across the monorepo:

- Electron 41 to 42 (42.4.0). Native modules now rebuild against Electron 42's ABI (146), so a `node-abi: ^3.92.0` override is added (older node-abi can't resolve Electron 42's ABI).
- better-sqlite3 to 12.10.1, which ships the upstream V8 sandbox external-pointer-tag fix for Electron 42's V8 (14.6), so it compiles cleanly with no patch.
- React 19.1 to 19.2.6, unified across code, web and mobile via overrides. `@types/react` and `@types/react-dom` are deduped to one copy (a second copy made nominally distinct `Ref` types and broke shared UI ref props).
- Vite 6 to 7 (with `@vitejs/plugin-react` on the Vite 7 line). Not Vite 8 or Rolldown: electron-vite 4 supports `vite ^5 || ^6 || ^7`, so 7 is the ceiling.
- tRPC 11.12 to 11.17, TanStack Query 5.90 to 5.101 and Router 1.95 to 1.170, Tailwind 4.2 to 4.3, Storybook 10.2 to 10.4, Playwright 1.42 to 1.60, turbo 2.6 to 2.9, plus minor bumps (MCP SDK, drizzle, electron-log, posthog-node, semver, dotenv, fflate, jimp, memfs, postcss, tsx, typed-openapi, yaml, adm-zip).
- zod deduped to a single 4.x line (`zod@^4.0.0` override) so cross-package schema types stay nameable.
- Two small code adaptations for the upgraded APIs: the TanStack Query `setQueryData` call sites in `useSignalTeamConfigMutations` and `useTaskMutations` (a typed optimistic value and an explicit updater generic).

Stacked on #2811 (electron-vite migration); review against `refactor/electron-vite`.

## How did you test this?

Locally on macOS arm64:

- `pnpm install` resolves cleanly and rebuilds better-sqlite3 against Electron 42.4.0 with no patch.
- `pnpm typecheck` (22 of 22 packages), `pnpm lint` and `pnpm build` all pass.
- `pnpm test` passes (`@posthog/core` 1615 tests and the rest). `@posthog/git` and `@posthog/agent` pass in isolation; they only flaked under concurrent build-plus-test load (a 15s git-ops timeout), not on their own.

The standard PR checks (typecheck, build, unit tests) run on this PR. The full signed and notarized multi-platform packaging, with the Electron 42 native rebuild and smoke test, runs via the build workflow on `refactor/electron-vite` once this lands there.

## Automatic notifications

- [ ] Publish to changelog?
- [ ] Alert Sales and Marketing teams?

Author: charlesvien

apps/code/package.json

@@ -42,48 +42,48 @@
   "license": "MIT",
   "devDependencies": {
     "@biomejs/biome": "2.2.4",
-    "@playwright/test": "^1.42.0",
-    "@posthog/rollup-plugin": "^1.4.0",
-    "@storybook/addon-a11y": "10.2.0",
-    "@storybook/addon-docs": "10.2.0",
-    "@storybook/react-vite": "10.2.0",
+    "@playwright/test": "^1.60.0",
+    "@posthog/rollup-plugin": "^1.4.4",
+    "@storybook/addon-a11y": "10.4.1",
+    "@storybook/addon-docs": "10.4.1",
+    "@storybook/react-vite": "10.4.1",
     "@tanstack/devtools-vite": "^0.7.0",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.0",
     "@testing-library/user-event": "^14.6.1",
     "@types/better-sqlite3": "^7.6.13",
     "@types/canvas-confetti": "^1.9.0",
     "@types/node": "^24.0.0",
-    "@types/react": "^19.1.0",
-    "@types/react-dom": "^19.1.0",
+    "@types/react": "^19.2.15",
+    "@types/react-dom": "^19.2.3",
     "@types/semver": "^7.7.1",
-    "@vitejs/plugin-react": "^4.2.1",
+    "@vitejs/plugin-react": "^4.7.0",
     "@vitest/ui": "^4.1.8",
-    "adm-zip": "^0.5.16",
-    "electron": "^41.0.0",
+    "adm-zip": "^0.5.17",
+    "electron": "^42.3.0",
     "electron-builder": "^26.15.3",
     "electron-vite": "^4.0.1",
     "husky": "^9.1.7",
-    "jimp": "^1.6.0",
+    "jimp": "^1.6.1",
     "jsdom": "^26.0.0",
     "lint-staged": "^15.5.2",
-    "memfs": "^4.56.10",
-    "postcss": "^8.4.33",
-    "storybook": "10.2.0",
-    "tailwindcss": "^4.2.2",
-    "tsx": "^4.20.6",
-    "typed-openapi": "^2.2.2",
+    "memfs": "^4.57.3",
+    "postcss": "^8.5.15",
+    "storybook": "10.4.1",
+    "tailwindcss": "^4.3.0",
+    "tsx": "^4.22.3",
+    "typed-openapi": "^2.2.6",
     "typescript": "^5.9.3",
-    "vite": "^6.0.7",
-    "vite-tsconfig-paths": "^5.1.4",
+    "vite": "^7.0.0",
+    "vite-tsconfig-paths": "^6.0.0",
     "vitest": "^4.1.8",
-    "yaml": "^2.8.1"
+    "yaml": "^2.9.0"
   },
   "dependencies": {
     "@fontsource-variable/inter": "^5.2.8",
     "@inversifyjs/strongly-typed": "2.2.0",
     "@json-render/core": "^0.19.0",
-    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@opentelemetry/api-logs": "^0.208.0",
     "@opentelemetry/exporter-logs-otlp-http": "^0.208.0",
     "@opentelemetry/resources": "^2.5.0",
@@ -109,21 +109,21 @@
     "@posthog/workspace-client": "workspace:*",
     "@posthog/workspace-server": "workspace:*",
     "@radix-ui/themes": "^3.2.1",
-    "@tailwindcss/vite": "^4.2.2",
-    "@tanstack/react-query": "^5.90.2",
-    "@tanstack/router-plugin": "^1.95.0",
-    "@trpc/client": "^11.12.0",
-    "@trpc/server": "^11.12.0",
-    "@trpc/tanstack-react-query": "^11.12.0",
-    "better-sqlite3": "^12.8.0",
+    "@tailwindcss/vite": "^4.3.0",
+    "@tanstack/react-query": "^5.100.14",
+    "@tanstack/router-plugin": "^1.168.13",
+    "@trpc/client": "^11.17.0",
+    "@trpc/server": "^11.17.0",
+    "@trpc/tanstack-react-query": "^11.17.0",
+    "better-sqlite3": "^12.10.1",
     "chokidar": "^5.0.0",
     "detect-libc": "^1.0.3",
-    "dotenv": "^17.2.3",
-    "drizzle-orm": "^0.45.1",
-    "electron-log": "^5.4.3",
+    "dotenv": "^17.4.2",
+    "drizzle-orm": "^0.45.2",
+    "electron-log": "^5.4.4",
     "electron-store": "^11.0.0",
     "electron-updater": "^6.8.9",
-    "fflate": "^0.8.2",
+    "fflate": "^0.8.3",
     "file-icon": "^6.0.0",
     "fzf": "^0.5.2",
     "ignore": "^7.0.5",
@@ -133,17 +133,17 @@
     "node-addon-api": "^8.5.0",
     "node-machine-id": "^1.1.12",
     "node-pty": "1.1.0",
-    "posthog-node": "^5.24.10",
+    "posthog-node": "^5.35.6",
     "radix-themes-tw": "0.2.3",
-    "react": "19.1.0",
-    "react-dom": "19.1.0",
+    "react": "19.2.6",
+    "react-dom": "19.2.6",
     "react-hotkeys-hook": "^4.4.4",
     "reflect-metadata": "^0.2.2",
-    "semver": "^7.6.0",
+    "semver": "^7.8.1",
     "shadcn": "^4.1.2",
-    "smol-toml": "^1.6.0",
+    "smol-toml": "^1.6.1",
     "tailwindcss-scroll-mask": "^0.0.3",
     "tw-animate-css": "^1.4.0",
-    "zod": "^4.1.12"
+    "zod": "^4.4.3"
   }
 }

apps/web/package.json

@@ -18,12 +18,12 @@
     "@posthog/shared": "workspace:*",
     "@posthog/ui": "workspace:*",
     "@posthog/workspace-client": "workspace:*",
-    "@tanstack/react-query": "^5.90.2",
-    "@trpc/client": "^11.12.0",
-    "@trpc/tanstack-react-query": "^11.12.0",
+    "@tanstack/react-query": "^5.100.14",
+    "@trpc/client": "^11.17.0",
+    "@trpc/tanstack-react-query": "^11.17.0",
     "inversify": "^7.10.6",
-    "react": "19.1.0",
-    "react-dom": "19.1.0",
+    "react": "19.2.6",
+    "react-dom": "19.2.6",
     "reflect-metadata": "^0.2.2"
   },
   "devDependencies": {

package.json

@@ -53,7 +53,7 @@
     "knip": "^5.66.3",
     "lint-staged": "^15.5.2",
     "mprocs": "^0.7.1",
-    "turbo": "^2.6.2"
+    "turbo": "^2.9.16"
   },
   "lint-staged": {
     "*.{ts,tsx,js,jsx}": [

packages/electron-trpc/package.json

@@ -32,11 +32,11 @@
     "@trpc/client": "^11.8.0",
     "@trpc/server": "^11.8.0",
     "@types/node": "^24.0.0",
-    "@vitest/coverage-v8": "^0.34.0",
-    "electron": "^41.0.0",
+    "@vitest/coverage-v8": "^2.1.8",
+    "electron": "^42.3.0",
     "superjson": "^2.2.2",
     "typescript": "^5.8.3",
-    "vite": "^6.0.7",
+    "vite": "^7.0.0",
     "vitest": "^2.1.8",
     "zod": "^4.2.0"
   },

packages/host-router/package.json

@@ -24,7 +24,8 @@
     "@posthog/shared": "workspace:*",
     "@posthog/workspace-client": "workspace:*",
     "@posthog/workspace-server": "workspace:*",
-    "@trpc/client": "catalog:"
+    "@trpc/client": "catalog:",
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
     "@tanstack/react-query": "catalog:",

packages/ui/package.json

@@ -108,6 +108,7 @@
     "unified": "^11.0.5",
     "virtua": "^0.48.6",
     "vscode-icons-js": "^11.6.1",
+    "zod": "^4.4.3",
     "zustand": "^4.5.0"
   },
   "peerDependencies": {

packages/ui/src/features/inbox/hooks/useSignalTeamConfigMutations.ts

@@ -67,12 +67,13 @@ export function useSignalTeamConfigMutations() {
       );
 
       if (previous) {
+        const optimistic: SignalTeamConfig = {
+          ...previous,
+          autostart_base_branches: branches,
+        };
         queryClient.setQueryData<SignalTeamConfig | null>(
           TEAM_CONFIG_QUERY_KEY,
-          {
-            ...previous,
-            autostart_base_branches: branches,
-          },
+          optimistic,
         );
       }
 

packages/ui/src/features/tasks/useTaskMutations.ts

@@ -124,7 +124,8 @@ export function useRenameTask() {
         if (previousDetail) {
           queryClient.setQueryData<Task | undefined>(
             taskKeys.detail(taskId),
-            (current) => rollbackDetailData(current, previousDetail, newTitle),
+            (current) =>
+              rollbackDetailData<Task>(current, previousDetail, newTitle),
           );
         }
         if (rollbackSession) {