chore(deps): salvaged the production group and held react on 19.2

[sunnypatell]

supersedes #49, which failed at npm ci before lint or build ever ran. takes everything from that group except react, plus the next 16.3.5 lockstep pair.

why react is held. @react-three/fiber@9.7.0 peers react ">=19 <19.3", and every v10 canary still peers <19.3, so 19.3.0 dies with ERESOLVE. re-confirmed with npm install react@19.3.0 --dry-run on this branch. added dependabot ignores for react, react-dom, @types/react and @types/react-dom >=19.3.0 so the production group stops re-proposing it weekly. types stay held with the runtime so they don't advertise 19.3 api the installed react doesn't have.

why three could move. postprocessing@6.39.5 raised its ceiling from < 0.186.0 to < 0.187.0, so three 0.186 only works if postprocessing moves with it. both move here.

package	from	to
three / @types/three	0.185.1 / 0.185.4	0.186.0
postprocessing (transitive)	6.39.4	6.39.5
next / eslint-config-next	16.3.4	16.3.5
lucide-react	1.40.0	1.46.0
tailwind-merge	3.6.0	3.7.0
zod	4.5.4	4.6.5

verified against a baseline from main, same probe before and after:

• clean rm -rf node_modules && npm ci installs 432 packages with no ERESOLVE, npm ls consistent
• hero: BrightnessContrast, Bloom, Vignette and the combined EffectPass construct identically on r186, and the real .glb parses to the same 2 meshes / 2 materials / bbox [2, 1.5473, 1.3239]
• tailwind-merge: ran all 311 className / cn() literals in src/ through twMerge alone and against an override. 0 outputs changed. 169 of those merges actually drop a conflicting class, so the probe is exercising resolution, not passthrough
• typecheck, lint, build green on node 22, npm audit 0, all 7 routes 200, motion ssr intact, resume previews still v5

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sunny-portfolio	Ready	Preview	Sep 14, 2026 2:45pm UTC