[github-actions]

✅ Latest-compatible dependency candidate

✅ Full candidate validation passed. Exact versions and hashes are captured in the attached dependency report and lock files.

Area	Dependency	Current	Candidate
go-module	github.com/xo/terminfo	v1.2.0	v1.3.0
npm-web	lucide-react	``	1.66.0
npm-web	motion	``	14.9.0
npm-web	react	``	19.3.1
npm-web	react-dom	``	19.3.1
npm-web	recharts	``	3.10.1

Release notes

• https://pkg.go.dev/github.com/xo/terminfo@v1.3.0
• https://www.npmjs.com/package/lucide-react
• https://www.npmjs.com/package/motion
• https://www.npmjs.com/package/react
• https://www.npmjs.com/package/react-dom
• https://www.npmjs.com/package/recharts

Impact review

• License: Review upstream licenses and regenerated THIRD_PARTY_NOTICES.md for: github.com/xo/terminfo, lucide-react, motion, react, react-dom, recharts.
• Security: web: 0 known npm audit findings (critical 0, high 0, moderate 0, low 0); build: 0 known npm audit findings (critical 0, high 0, moderate 0, low 0)
• Size: firmware 32300/32384 bytes (84 free); Urboot-Custom 510/512 bytes; compressed host executable 6893056 bytes (upx 5.3.0)

Validation and review

• Stable channels resolved; prerelease and branch canaries remained observation-only.
• Firmware, Urboot-Custom, VirtualBoard, Go, web, resources, and packaging gates passed.
• Reviewer inspected upstream release notes and any license/security changes.
• Reviewer confirmed immutable GitHub Action revisions and generated lock provenance.

Workflow evidence: https://github.com/atomicdeploy/PCController/actions/runs/41371864861