chore(deps): upgrade all dependencies (2026-07-13)

[devin-ai-integration]

Summary

Upgrades outdated npm dependencies across the full-stack app (React frontend + Express/GraphQL backend + Cypress), branched from develop, following the "Upgrade All Dependencies" playbook. Work is split into logical commits by risk: one patch batch, one minor batch, then majors one-at-a-time / in tightly-coupled groups. Yarn (classic, 1.22.22) is used throughout because yarn.lock exists; Node pinned to .nvmrc 22.13.0. Each package keeps its existing version-prefix convention (exact stays exact, ^ stays ^).

After each accepted change the gate yarn types && yarn lint && yarn build && yarn test:unit:ci passed (real exit codes, no pipe masking). The full stack was booted with repo scripts and the frontend was manually exercised (login → feed → new-payment flow → bank accounts → notifications → user settings) with a recorded walkthrough; no JS console errors (only vite dev logs + a pre-existing XState 4 deprecation warning).

The high-risk majors that require broad refactors or are blocked by the pinned Node/toolchain were attempted and reverted, and are documented below with concrete reasons — nothing was silently skipped.

Validation

• yarn types ✅ yarn lint ✅ yarn build ✅ yarn test:unit:ci ✅
• Backend boots on Express 5 and serves /graphql (200); GraphQL proxy verified.
• Frontend walkthrough recorded (164s, > 30s), no console errors.

Video demo

Interactive frontend walkthrough (login, feed, payment stepper, bank accounts, notifications, settings): https://app.devin.ai/attachments/26a26b11-26fc-4ac1-81e3-9fa13cd3914d/upgrade_demo.mp4

Upgraded packages

Patch (commit chore(deps): upgrade patch dependencies)

@types/detect-port 1.3.2→1.3.5 · formik 2.4.6→2.4.9 · react-calendar 6.0.0→6.0.1 · react-virtualized 9.22.5→9.22.6 · shortid 2.2.16→2.2.17 · @percy/cypress 3.1.6→3.1.9 · @types/bluebird 3.5.36→3.5.42 · @types/connect-flash 0.0.37→0.0.40 · @types/cors 2.8.12→2.8.19 · @types/json-server 0.14.4→0.14.8 · @types/morgan 1.9.3→1.9.10 · @types/passport 1.0.16→1.0.17 · @types/react-router 5.1.18→5.1.20 · babel-loader 10.0.0→10.1.1 · cors 2.8.5→2.8.6 · graphql-http 1.22.0→1.22.4

Minor (commit chore(deps): upgrade minor dependencies)

@auth0/auth0-react 2.2.4→2.21.0 · @emotion/styled 11.11.0→11.14.1 · @okta/okta-react 6.7.0→6.11.0 · aws-amplify 6.0.16→6.18.0 · date-fns 4.1.0→4.4.0 · detect-port 1.5.1→1.6.1 · @percy/cli 1.27.4→1.32.3 · @types/connect-history-api-fallback 1.3.5→1.5.4 · @types/express-session 1.18.0→1.19.0 · @types/react-virtualized 9.21.21→9.22.3 · @types/validator 13.7.2→13.15.10 · @types/webpack-env 1.16.4→1.18.8 · cypress 15.0.0→15.18.1 · express-session 1.18.0→1.19.0 · morgan 1.10.0→1.11.0 · passport 0.5.0→0.7.0 · prettier 3.0.0→3.9.5 · typescript-eslint 8.46.2→8.63.0

Major (accepted — separate commits)

Package	Old → New	Notes / migration
axios	0.28.1 → 1.18.1	source dep; security-relevant
uuid	8.3.2 → 14.0.1	+ @types/uuid 8→11
clsx	1.2.1 → 2.1.1	source dep
bcryptjs	2.4.3 → 3.0.3	+ @types/bcryptjs 2→3 (backend)
fuse.js	6.5.3 → 7.4.2	source dep
react-number-format	4.9.4 → 5.4.5	NumberFormat→NumericFormat, isNumericString→valueIsNumericString in TransactionCreateStepTwo.tsx
@testing-library/react	14 → 16.3.2	added explicit @testing-library/dom ^10.4.1 peer
@testing-library/jest-dom	5 → 6.9.1	import * as matchers in src/setup-tests.js
@cypress/code-coverage	3 → 4.0.3	dev/test
jsdom	22 → 29.1.1	unit-test env (Vitest 3)
express	4.20.0 → 5.2.1	+ @types/express 5, @types/express-serve-static-core 5; handler return typing fixed in backend/user-routes.ts (no wildcard routes → no path-to-regexp changes)
express-validator	6 → 7.3.2	removed sanitizeQuery → query(...).customSanitizer in backend/validators.ts
graphql	16 → 17.0.2	with graphql-tools 8→9, @graphql-tools/load 7→8, @graphql-tools/graphql-file-loader 7→8
http-proxy-middleware	0.19.1 → 3.0.5	named export + pathFilter in src/setupProxy.js (v4 is ESM-only — skipped)
connect-history-api-fallback	1 → 2.0.0	dev static server
@okta/jwt-verifier	3 → 4.0.2	backend auth
@okta/okta-auth-js	7 → 8.0.1	frontend auth
yup	0.32.11 → 1.7.1	removed obsolete @types/yup (ships own types)
eslint	9 → 10.7.0	with @eslint/js 9→10, eslint-plugin-cypress 5→6; Error(..,{cause}) in Query.ts for preserve-caught-error
husky	7 → 9.1.7	git hooks
concurrently	9 → 10.0.3	dev scripts
cross-env	7 → 10.1.0	dev scripts
dotenv	16 → 17.4.2	dev/backend
nodemon	2 → 3.1.14	dev
nyc	15 → 18.0.0	coverage
patch-package	7 → 8.0.1	postinstall (removed obsolete react-virtualized+9.22.5.patch)
start-server-and-test	1 → 3.0.11	CI scripts
wait-on	8 → 9.0.10	CI scripts
@types/node	20 → 22.20.1	tracked to Node-22 line (repo target); latest 26 targets Node 26
@types/jsonwebtoken	8 → 9.0.10	types
@types/jwt-decode	2 → 3.1.0	types
@types/shortid	0.0.29 → 2.2.0	types

Security fixes

Source/runtime upgrades that resolve known advisories: axios 0.28→1.18 (SSRF / credential-leak advisories in 0.x), http-proxy-middleware 0.19→3, express 4→5, passport 0.5→0.7, morgan and express-session bumps, graphql 16→17. Note: yarn audit still reports transitive advisories concentrated in dev-only tooling (cypress, aws-amplify, webpack) whose fixes require the skipped majors below; no production runtime path is affected by those.

Skipped majors (attempted, reverted, documented)

Package(s)	Target	Reason
react / react-dom (+@types/react,@types/react-dom)	18→19	Coupled to MUI 6+ and react-router 6/7; MUI 5 peer is react `^17
react-router / react-router-dom / history (+@types/*)	5→8 / 5→7 / 4→5	88 usages of removed v5 APIs (Switch, Redirect, useHistory, component=, withRouter) across routing + XState machines. Large rewrite.
@mui/material / @mui/icons-material / @mui/lab	5→9	82 <Grid> usages need item/xs→size migration across a 5→9 multi-major span; @mui/lab only at 9.0.0-beta. Large.
xstate / @xstate/react	4→5 / 3→6	Full machine-API rewrite (services→actors, actions) across 14 machines.
lowdb (+@types/lowdb)	1→7	No default export, FileSync adapter removed, entire sync lodash-chain API (db.get().push().write(), .value()) replaced by async Low across ~40 call sites in backend/database.ts.
dinero.js (+@types/dinero.js)	1→2	Functional/immutable rewrite + new @dinero.js/currencies dep; changes money formatting asserted by E2E.
@faker-js/faker	6→10	~45 old-API call sites in scripts/seedDataUtils.ts.
typescript	5→7	Removes tsconfig baseUrl / moduleResolution=node10; needs broader tsconfig migration (7.x also pre-release).
vite / @vitejs/plugin-react / vite-plugin-istanbul	7→8 / 5→6 / 4→9	Rolldown/ESM config migration; also breaks Vitest linking under Yarn 1.
vitest	3→4	Yarn v1 "could not find a copy of vite to link" invariant; coupled to the Vite 8 migration.
@babel/core / @babel/preset-env / @babel/plugin-*	7→8	Require Node ≥ 22.18; repo pins Node 22.13 (.nvmrc).
npm	9→12	Requires Node ≥ 22.22; repo pins Node 22.13.
express-jwt / jwks-rsa	6→8 / 2→4	Removes bundled @types/express-jwt and changes auth-middleware API; needs runtime IdP validation not available here.
http-proxy-middleware v4	3→4	ESM-only; breaks the CommonJS require under ts-node. Accepted v3 instead.
detect-port	1→2	Pulls Node builtin debuglog that breaks the Vite browser bundle (imported via frontend port utils). Kept 1.x.
@types/lodash	4.14→4.17	Union comparator typing regression (Transaction | Like) in scripts/seedDataUtils.ts. Kept 4.14.

Notes

• Cypress is already on the latest v15 line — bumped 15.0.0→15.18.1; E2E/component config (cypress.config.ts, vite.cypress.config.ts) and seeds preserved unchanged.
• Removed now-redundant @types/yup and @types/http-proxy-middleware (v1 / v3 ship their own types).

Link to Devin session: https://app.devin.ai/sessions/8dc3f03779dd4bc39a6cca1493b5051f
Requested by: @dr-phil

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Frontend recording

Watch the upgraded full-stack app walkthrough