frontend: update the UI registry past 3.4.1

[SpicyPete]

Summary

The vendored registry under redpanda-ui/ had fallen behind the deployed registry. 137 of 166 files differed, and none of it was cosmetic: upstream landed the import type React pass, refactored useIsMobile onto useMediaQuery, and reworked combobox, multi-select and motion-highlight substantially.

Pulled by fetching the per-item payloads for all 92 installed items and writing the published bytes, then asserting byte-parity for every target. No item carries a cssVars, css or tailwind payload, and no target falls outside the vendored directory, so a direct write is equivalent to a CLI pull and is auditable in a way shadcn add --overwrite is not. bun run lint leaves the tree at parity, checked against a pre-lint snapshot.

What comes with it

• sanitized-html is new in the dependency closure. code-block, code-tabs and code-block-dynamic all require it now and all three are installed, so without it they break.
• auto-form/renderers/renderer-types.ts is a new file in the auto-form item.
• Four console-owned files in that directory are untouched: highlighted-input.tsx, listbox.tsx, stat/index.tsx, and the secret-selector-scopes.test.ts guard test we keep because the registry ships that file untested.

Dependencies

Console was behind the registry on three ranges, so they move to what it asks for:

Package	Before	After
@base-ui/react	^1.7.0	^1.8.0
@tanstack/react-table	^9.1.2	^9.2.3
zod	^4.4.3	^4.6.1

lottie-web becomes a direct dependency at ^5.13.0. loading-animation.tsx imports it directly and it was only reaching us through lottie-react, so it was a phantom dependency that happened to resolve. dompurify, which sanitized-html needs, was already pinned at exactly the range it asks for. Both lockfiles are regenerated with the pinned bun (1.4.0).

Ranges where console is ahead of the registry are left alone: @bufbuild/protobuf and @tanstack/react-router.

Callsite changes

Link now requires href. The two react-markdown anchor renderers passed string | undefined, since markdown can produce an anchor with no destination, so they render that case as text rather than a dead link.

Theming

style/theme.css looks noisy but is semantically identical: rewrapped --shadow-* values and one font-weight/line-height reorder. All 207 custom properties are unchanged in both name and value, so the token contract with cloud-ui is untouched and this does not need a paired change there.

Testing

type:check, lint, build, and both test suites at 1063 unit and 1602 integration, all matching master's baseline exactly, so the pull is test-neutral. The only type errors the upgrade produced were the two Link callsites above.

Reviewers: the registry files are vendored upstream content, so the diff worth reading is package.json, the two callsites, and the fact that byte-parity is asserted rather than eyeballed.

🤖 Generated with Claude Code

[github-actions]

✅ Clean — no registry drift, off-token colours, or ad-hoc classes

App: frontend · Scope: diff vs origin/master · Files: 2

	Count
⚠️ Outdated registry components	0
🛠 Locally-modified components	0
❓ Unknown to registry	0
🎨 Off-token palette colours	0
🔢 Ad-hoc utility classes	0

Generated by lookout audit-changes.