[github-actions]

✅ Latest-compatible dependency candidate

✅ Full candidate validation passed. Exact versions and hashes are captured in the attached dependency report and lock files.

Area	Dependency	Current	Candidate
host	Go	1.27.2	1.27.3
host-tools	Node.js LTS	24.21.0	24.22.1
host-tools	Node.js distribution inventory	e8832fcbecd010a1c21900bc019a28455f15adb34b81eea8e610068bed57c5f1	e25c8108e734d16db06dc253b24b38b693e9ac6b7a72a0a984b51bd7a9683053
host-tools	Windows C compiler package	16.2.0-14.0.0-r1	16.2.0-14.0.0-r3
host-tools	Windows C compiler identity	9ef40a27504e87ff69d6aa51b69c7ab577e705a42dd08e8992a0cc258c24156d	aa580d9a6dd322247d52f0111e4831a0116e442e33732229821a47e02ea17757
github-actions	GitHub Actions	1d349bfe5eec49b09f2557742d65c11b48fa332845882f397a625b02878ae9bb	f3ae6cf725ad8fb85eaf8cf02cdba8005166e56fb67c898e0c03aea237bf76b3
go-toolchain	go directive	1.27.2	1.27.3
go-module	github.com/Microsoft/go-winio	v0.6.3	v0.6.4
npm-web	lucide-react	``	1.61.0
npm-web	motion	``	14.6.0
npm-web	react	``	19.3.1
npm-web	react-dom	``	19.3.1
npm-web	recharts	``	3.10.1

Release notes

• https://go.dev/doc/devel/release#go1.27.3
• https://nodejs.org/en/blog/release/v24.22.1
• https://nodejs.org/en/blog/release/ve25c8108e734d16db06dc253b24b38b693e9ac6b7a72a0a984b51bd7a9683053
• https://pkg.go.dev/github.com/Microsoft/go-winio@v0.6.4
• https://www.npmjs.com/package/lucide-react
• https://www.npmjs.com/package/motion
• https://www.npmjs.com/package/react
• https://www.npmjs.com/package/react-dom
• https://www.npmjs.com/package/recharts

Impact review

• License: Review upstream licenses and regenerated THIRD_PARTY_NOTICES.md for: Go, Node.js LTS, Node.js distribution inventory, Windows C compiler package, Windows C compiler identity, GitHub Actions, go directive, github.com/Microsoft/go-winio, lucide-react, motion, react, react-dom, recharts.
• Security: web: 0 known npm audit findings (critical 0, high 0, moderate 0, low 0); build: 0 known npm audit findings (critical 0, high 0, moderate 0, low 0)
• Size: firmware 32286/32384 bytes (98 free); Urboot-Custom 510/512 bytes; compressed host executable 6868992 bytes (upx 5.2.1)

Validation and review

• Stable channels resolved; prerelease and branch canaries remained observation-only.
• Firmware, Urboot-Custom, VirtualBoard, Go, web, resources, and packaging gates passed.
• Reviewer inspected upstream release notes and any license/security changes.
• Reviewer confirmed immutable GitHub Action revisions and generated lock provenance.

Workflow evidence: https://github.com/atomicdeploy/PCController/actions/runs/40255253094