chore(code): upgrade Electron 42, React 19.2, Vite 7 and deps

[charlesvien]

Problem

We had fallen several majors behind on core dependencies (Electron 41, React 19.1, Vite 6) plus a long tail of libraries, missing performance, security and bug fixes. A previous attempt (#2512) predated the electron-builder and electron-vite migration and was closed, so this redoes the upgrade from first principles on top of that work.

Changes

Dependency modernization across the monorepo:

• Electron 41 to 42 (42.4.0). Native modules now rebuild against Electron 42's ABI (146), so a node-abi: ^3.92.0 override is added (older node-abi can't resolve Electron 42's ABI).
• better-sqlite3 to 12.10.1, which ships the upstream V8 sandbox external-pointer-tag fix for Electron 42's V8 (14.6), so it compiles cleanly with no patch.
• React 19.1 to 19.2.6, unified across code, web and mobile via overrides. @types/react and @types/react-dom are deduped to one copy (a second copy made nominally distinct Ref types and broke shared UI ref props).
• Vite 6 to 7 (with @vitejs/plugin-react on the Vite 7 line). Not Vite 8 or Rolldown: electron-vite 4 supports vite ^5 || ^6 || ^7, so 7 is the ceiling.
• tRPC 11.12 to 11.17, TanStack Query 5.90 to 5.101 and Router 1.95 to 1.170, Tailwind 4.2 to 4.3, Storybook 10.2 to 10.4, Playwright 1.42 to 1.60, turbo 2.6 to 2.9, plus minor bumps (MCP SDK, drizzle, electron-log, posthog-node, semver, dotenv, fflate, jimp, memfs, postcss, tsx, typed-openapi, yaml, adm-zip).
• zod deduped to a single 4.x line (zod@^4.0.0 override) so cross-package schema types stay nameable.
• Two small code adaptations for the upgraded APIs: the TanStack Query setQueryData call sites in useSignalTeamConfigMutations and useTaskMutations (a typed optimistic value and an explicit updater generic).

Stacked on #2811 (electron-vite migration); review against refactor/electron-vite.

How did you test this?

Locally on macOS arm64:

• pnpm install resolves cleanly and rebuilds better-sqlite3 against Electron 42.4.0 with no patch.
• pnpm typecheck (22 of 22 packages), pnpm lint and pnpm build all pass.
• pnpm test passes (@posthog/core 1615 tests and the rest). @posthog/git and @posthog/agent pass in isolation; they only flaked under concurrent build-plus-test load (a 15s git-ops timeout), not on their own.

The standard PR checks (typecheck, build, unit tests) run on this PR. The full signed and notarized multi-platform packaging, with the Electron 42 native rebuild and smoke test, runs via the build workflow on refactor/electron-vite once this lands there.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[charlesvien]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• test(updates): macOS auto-update E2E with real install + relaunch #2828
• feat(updates): update modal, auto-download setting, changelog #2818
• chore(code): upgrade Electron 42, React 19.2, Vite 7 and deps #2817 👈 (View in Graphite)
• refactor(code): migrate build and dev to electron-vite #2811
• refactor(code): migrate from electron forge to electron-builder #2795
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 96ed56f.}

[stamphog]

Gates denied this PR: it touches dependencies and toolchain (Electron, React, Vite major version bumps) which are on the deny-list, and it exceeds the size ceiling at 6791 lines across a lockfile and multiple package.json files. Dependency/toolchain upgrades of this scale require human review.

[greptile-apps]

_{Reviews (1): Last reviewed commit: "upgrade electron 42, react 19.2, vite 7 ..." | Re-trigger Greptile}

[stamphog]

Gates denied this PR: it touches dependencies and toolchain (Electron, React, Vite major version bumps) which are on the deny-list, and it exceeds the size ceiling at 6791 lines across a lockfile and multiple package.json files. Dependency/toolchain upgrades of this scale require human review.

[stamphog]

Gates denied this PR because it touches dependencies and toolchain (Electron, React, Vite major version bumps), which are on the deny-list. This requires a human reviewer to assess compatibility, breaking changes, and runtime risk.