Dependency compatibility sweep: React 19.3, Radix 1.6.7, Vercel Analytics 2, tooling

[spizeck]

Summary

Deliberate dependency audit + upgrade pass against current main, superseding six stale Dependabot PRs (#91, #43, #41, #39, #38, #36). Each dependency was evaluated against upstream release notes and the app's actual usage before upgrading; the final combination was validated as a set.

What was upgraded — and why each is compatible

Dependency	Old	New	Compatibility basis
react + react-dom	19.2.3	19.3.0	Additive minor (ViewTransition, Fragment refs, Trusted Types — none used here). next@16.3.5 peer range ^19.0.0 covers it. Pins kept lockstep; check:react-versions passes.
radix-ui	1.4.3	1.6.7	1.5–1.6.x is largely React 19.2 compat: fixes stale onEscapeKeyDown/onDismiss handlers, the DismissableLayer useEffectEvent regression, a React 19 ref-callback re-render loop, and broken Dialog ARIA references. 1.6.7 reverted an interim RSC regression. DDB's surface is Dialog/Tabs/Slot only (the tour date picker is custom code).
@vercel/analytics	1.6.1	2.0.1	The only 2.0 breaking changes are Nuxt module pathing and the license (MPL→MIT). @vercel/analytics/next <Analytics /> usage is unchanged; peers allow React 19 / Next ≥13. Consent/Klaro/GA4 architecture untouched.
tailwindcss + @tailwindcss/postcss	4.1.18	4.3.3	4.2.x/4.3.x releases are all bug fixes (color canonicalization, selector parsing, shadow opacity, CJK font stack); no utility redesigns. Build + full smoke suite + visual spot-checks confirm identical rendering.
playwright	1.62.1	1.63.0	Minor; the full smoke suite ran green on the new browser build.
tsx	4.21.0	4.23.15	Minor/patch test-runner upgrade (newer than PR #43's 4.23.13).
firebase-tools	15.29.0	15.30.2	Patch/minor; Firestore+Storage emulator suite: 29/29 pass with identical denial-behavior logs.
actions/setup-java	v5	v6	Same distribution: temurin/java-version: 21 config; v6's breaking changes (Azul metadata API, Maven cache keys) don't touch this usage. Proven by this PR's CI run.

Nothing was held back — every proposed upgrade passed review and validation.

Application-code changes required

None. The only non-manifest change is actions/setup-java@v5 → @v6 in ci.yml. Existing security overrides (@opentelemetry/core, esbuild, postcss, uuid) preserved.

Validation (clean npm install on Node 24)

• check:react-versions — react/react-dom match at 19.3.0
• npx tsc --noEmit — clean
• npm run lint — pass (one pre-existing jsx-ast-utils warning, unrelated)
• npm test — 319 pass, 0 fail
• npm run test:rules — 29 pass under firebase-tools 15.30.2
• npm run build — clean (31 pages)
• npx playwright test — 112 pass, 0 fail, including all 20+ tour-inquiry dialog tests
• check:md-links — clean
• npm audit --omit=dev — 0 vulnerabilities; npm audit shows 5 moderate findings, all inside firebase-tools' dev-only transitive tree (csv-parse, stream-json, @opentelemetry/core via pubsub — pre-existing class of finding; the suggested --force fix would downgrade firebase-tools two majors, not applied)
• npm ls — no invalid/conflicting peers; react@19.3.0 deduped across @sentry/nextjs, @vercel/analytics, @vercel/speed-insights, @mdx-js/react, embla-carousel-react, radix-ui
• Visual: homepage, tour dialog, open calendar, mobile 375px — no rendering regressions; nested Escape verified (calendar closes first, then dialog)

Radix / tour-dialog regression evidence

The existing smoke-tests/tour-inquiry.spec.ts suite is the regression harness: dialog open/close from every entry point, Escape → focus restore, calendar arrow-key navigation, past-date blocking, short-viewport scrolling, 320/375px overflow, axe audit, WhatsApp handoff, tour_inquiry_click firing — all pass. Manual spot-check on the production build additionally confirmed the layered dismiss order (first Escape closes the date picker, second closes the dialog) and correct role="dialog" + aria-labelledby/aria-describedby wiring under Radix 1.6.7.

Supersedes

• chore(deps): bump @vercel/analytics from 1.6.1 to 2.0.1 #91 (@vercel/analytics 2.0.1) — same target, incorporated
• chore(deps): bump the dev-tooling group across 1 directory with 4 updates #43 (dev-tooling group) — incorporated, with tsx taken to 4.23.15 instead of 4.23.13
• chore(deps): bump radix-ui from 1.4.3 to 1.6.7 #41 (radix-ui 1.6.7) — same target, incorporated
• chore(deps): bump the react group across 1 directory with 2 updates #39 (react/react-dom 19.3.0) — same target, incorporated
• chore(deps): bump firebase-tools from 15.29.0 to 15.30.2 in the firebase-tooling group across 1 directory #38 (firebase-tools 15.30.2) — same target, incorporated
• chore(deps): bump actions/setup-java from 5 to 6 #36 (actions/setup-java v6) — same target, incorporated

Generated with Devin

Summary by Sourcery

Upgrade project dependencies and improve beer carousel accessibility with deterministic end-to-end interaction coverage.

New Features:

• Add a test-only carousel fixture route with deterministic data for reliable Playwright coverage.

Bug Fixes:

• Prevent pointer interactions from unexpectedly re-aligning the beer carousel while preserving keyboard focus scrolling.

Enhancements:

• Expand carousel accessibility documentation and regression coverage for keyboard focus, pointer interaction, dragging, and arrow navigation.

Build:

• Upgrade React, Radix UI, Vercel Analytics, Tailwind CSS, Playwright, tsx, and Firebase tooling dependencies.

CI:

• Upgrade the Java setup action used by the CI workflow to v6.

Documentation:

• Document the carousel fixture route and its SEO and accessibility behavior.

Tests:

• Add Playwright smoke tests covering carousel pointer, keyboard, drag, and arrow interactions.

Follow-up: carousel click bug found on the preview (commit 10ea91f)

Preview testing surfaced a pre-existing interaction bug unrelated to the dependency upgrades (reproduced identically on main at d44ecb2): each carousel slide's onFocus handler called emblaApi.scrollTo(index), and a pointer click focuses the card link — so clicking any card re-aligned it to the align: "start" position immediately before navigation.

Fix: the scroll is now gated on :focus-visible, so keyboard focus still scrolls an off-screen slide into view while pointer/touch focus never moves the track. New smoke-tests/carousel.spec.ts (via env-gated /carousel-fixture, same pattern as the other fixture routes) covers pointer click, keyboard focus-into-view, drag, and arrow navigation — the pointer test fails against the old code (728px jump) and passes with the fix. Post-fix validation: 319 unit, 29 rules, build clean, 116 Playwright pass (one SEO goto cold-start flake passed on re-run), md-links clean, npm audit --omit=dev 0 vulns.

[sourcery-ai]

Sorry @spizeck, this account has used its review budget of 1,500,000 diff characters for the last 7 days.

You can request another review in 1 hour and 10 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
deepdivebrewing-web	Ready	Preview	Sep 23, 2026 3:25pm UTC

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This dependency compatibility sweep updates React, Radix UI, Vercel Analytics, Tailwind, Playwright, Firebase tooling, tsx, and the CI Java setup action, regenerates the lockfile, and relies on comprehensive automated and visual validation to show that existing application behavior remains unchanged.

Sequence diagram for CI validation with upgraded tooling

sequenceDiagram
    participant CI as GitHub Actions
    participant Java as setup-java v6
    participant Install as npm install
    participant Build as Build and type checks
    participant E2E as Playwright 1.63.0
    participant Firebase as Firebase emulators

    CI->>Java: setup-java
    Java-->>CI: Temurin JDK 21
    CI->>Install: npm install
    Install-->>CI: Install upgraded dependency set
    CI->>Build: npm run build
    Build-->>CI: Build succeeds
    CI->>E2E: playwright test
    E2E->>Firebase: Run emulator-backed tests
    Firebase-->>E2E: Rules tests pass
    E2E-->>CI: Smoke tests pass

Loading

File-Level Changes

Change	Details	Files
Upgrade the runtime dependency set to React 19.3, Radix UI 1.6.7, and Vercel Analytics 2.0.1 while preserving existing application APIs and security overrides.	Keep react and react-dom pinned to the same 19.3.0 version and verify peer compatibility with Next.js and dependent packages. Update Radix UI and validate dialog, focus restoration, nested Escape handling, ARIA wiring, and date-picker interactions. Upgrade Vercel Analytics without changing the existing Next.js integration or consent/GA4 architecture. Regenerate the lockfile and confirm there are no invalid or conflicting peer dependencies.	package.json package-lock.json
Refresh CSS, browser-testing, test-runner, and Firebase emulator tooling with no intended application-code changes.	Upgrade Tailwind CSS/PostCSS and verify build output and visual rendering. Upgrade Playwright and run the full browser smoke suite, including tour-inquiry dialog coverage. Upgrade tsx and firebase-tools, confirming all Firestore and Storage rules tests pass. Retain existing security overrides and assess remaining audit findings as dev-only firebase-tools transitive vulnerabilities.	package.json package-lock.json
Update the CI Java runtime setup action while retaining the existing JDK configuration.	Move actions/setup-java from v5 to v6 with Temurin Java 21 unchanged. Validate the updated action through the CI workflow and emulator-dependent tests.	.github/workflows/ci.yml
Validate the complete dependency combination across type checking, linting, tests, build, browser behavior, links, and dependency health.	Confirm React versions match, TypeScript and lint checks pass, and the production build generates all expected pages. Pass 319 unit tests, 29 emulator rules tests, and 112 Playwright tests with no failures. Verify mobile and dialog visual behavior, layered dismissal order, accessibility wiring, analytics handoff, and zero production audit vulnerabilities.	package.json package-lock.json .github/workflows/ci.yml

Possibly linked issues

• Add Dependabot for npm and GitHub Actions #14: The PR directly resolves the issue by upgrading Next.js to 16.3.5, though it includes additional dependency maintenance.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Sourcery assessment

Approved.