[JJJ]

Summary

• Update the npm minor and patch dependency group from build(deps): bump the npm-minor-and-patch group with 5 updates #385.
• Regenerate the canonical license, notice, and source SBOM artifacts.
• Preserve the crate-root rfd attribution when Cargo About selects its nested XDG portal license.
• Replace the unsigned automation history with signed commits based on current main.

Validation

• npm run test:frontend

[Copilot]

🟡 Changes recommended

The license artifacts omit rfd’s required copyright attribution by incorrectly mapping the component to ashpd’s notice, so rfd’s crate-specific notice and mapping must be restored.

1 open issue

• Restore rfd copyright attribution in generated license notices · New

What changed in this PR

Updates Pasted’s frontend dependencies from the group proposed in #385 and refreshes the associated compliance artifacts.

Changes:

• Updates Lucide, Tailwind CSS, Vite, and the React Vite plugin.
• Refreshes transitive dependencies and removes duplicate Lightning CSS lockfile entries.
• Updates Lucide’s SBOM metadata and regenerates third-party notices.

File	Description
THIRD_PARTY_SBOM.spdx.json	Updates Lucide’s version, package identifier, and document namespace.
THIRD_PARTY_NOTICES.txt	Updates Lucide’s version and consolidates license notice entries.
package.json	Raises dependency ranges for Lucide and frontend build tooling.
package-lock.json	Locks updated dependencies and deduplicates Lightning CSS packages.

_{Review effort: Balanced}