chore(deps): upgrade all dependencies (2026-07-27)

[devin-ai-integration]

Summary

Upgrades every dependency that can be upgraded without an invasive migration: 19 patch, 21 minor and 30 major bumps, in separate commits (patch batch → minor batch → one commit per major). Six majors needed source changes, seven were reverted as too invasive, and eight could not be installed at all because their engines require a newer Node than .nvmrc (22.13.0).

The behaviour-preserving source adaptations are the interesting part of the diff:

package	breaking change	adaptation
express-jwt 6→8	default export is no longer callable; decoded claims move to req.auth	import { expressjwt, Params }, configs typed as Params with requestProperty: "user" so req.user keeps working
express-validator 6→7	sanitizeQuery removed	query("status").customSanitizer(...)
fuse.js 6→7	search("") now returns every item instead of none	setupSearch short-circuits to [] on an empty query, preserving "clearing the search empties the list"
passport 0.5→0.7	req.logout is asynchronous	destroy the session inside the req.logout callback (previously passport dereferenced an already-destroyed req.session and crashed the backend)
react-number-format 4→5	no default export	NumericFormat + valueIsNumericString
@testing-library/*	jest-dom has no default export; @testing-library/dom is now a peer	namespace import in src/setup-tests.js, @testing-library/dom added
eslint 9→10	new preserve-caught-error rule	throw new Error(err, { cause: err })
react-virtualized 9.22.5→9.22.6	upstream fixed the broken ESM import	patches/react-virtualized+9.22.5.patch deleted (patch-package no longer has anything to apply)

-export const setupSearch = curry((items, options, query) => {
+export const setupSearch = curry((items, options, query) => {
+  if (!query) return [];
   const fuse = new Fuse(items, options);
   return fuse.search(query);
 });

Upgrades

Patch (1ee523d)

package	old → new	scope
@emotion/styled	^11.11.0 → ^11.14.1	prod
formik	2.4.6 → 2.4.9	prod
react-calendar	^6.0.0 → ^6.0.1	prod
react-virtualized	9.22.5 → 9.22.6	prod
shortid	2.2.16 → 2.2.17	prod
@percy/cypress	3.1.6 → 3.1.9	dev
@types/bcryptjs	2.4.2 → 2.4.6	dev
@types/bluebird	3.5.36 → 3.5.42	dev
@types/connect-flash	0.0.37 → 0.0.40	dev
@types/cors	2.8.12 → 2.8.19	dev
@types/dinero.js	1.9.0 → 1.9.4	dev
@types/json-server	0.14.4 → 0.14.8	dev
@types/lowdb	1.0.11 → 1.0.15	dev
@types/morgan	1.9.3 → 1.9.10	dev
@types/passport	1.0.16 → 1.0.17	dev
@types/react-router	5.1.18 → 5.1.20	dev
@types/yup	0.29.13 → 0.29.14	dev
cors	2.8.5 → 2.8.6	dev
graphql-http	^1.22.0 → ^1.22.4	dev

Minor (8840ffb)

package	old → new	scope
@auth0/auth0-react	2.2.4 → 2.22.0	prod
@babel/core	^7.28.0 → ^7.29.7	prod
@babel/plugin-syntax-flow	^7.14.5 → ^7.29.7	prod
@babel/plugin-transform-react-jsx	^7.14.9 → ^7.29.7	prod
@okta/okta-react	^6.7.0 → ^6.11.0	prod
aws-amplify	^6.0.16 → ^6.19.0	prod
date-fns	4.1.0 → 4.4.0	prod
@babel/preset-env	^7.28.0 → ^7.29.7	dev
@percy/cli	^1.27.4 → ^1.32.5	dev
@types/connect-history-api-fallback	1.3.5 → 1.5.4	dev
@types/express-session	1.18.0 → 1.19.0	dev
@types/react-virtualized	9.21.21 → 9.22.3	dev
@types/validator	13.7.2 → 13.15.10	dev
@types/webpack-env	1.16.4 → 1.18.8	dev
babel-loader	^10.0.0 → ^10.1.1	dev
cypress	15.0.0 → 15.19.0	dev
express-session	1.18.0 → 1.19.0	dev
morgan	1.10.0 → 1.11.0	dev
passport	0.5.0 → 0.7.0	dev
prettier	^3.0.0 → ^3.9.6	dev
typescript-eslint	^8.46.2 → ^8.65.0	dev

prettier 3.9 reformatted a handful of files; that reformatting is part of the minor commit.

Major (one commit each)

package	old → new	scope	source changes
axios	0.28.1 → 1.18.1	prod	–
clsx	1.2.1 → 2.1.1	prod	–
uuid (+@types/uuid)	8.3.2 → 14.0.1	prod	–
yup	0.32.11 → 1.7.1	prod	–
react-number-format	4.9.4 → 5.4.5	prod	NumericFormat, valueIsNumericString
@okta/jwt-verifier	^3.0.1 → ^4.0.2	prod	–
@okta/okta-auth-js	^7.3.0 → ^8.0.1	prod	–
graphql (+graphql-tools, @graphql-tools/load, @graphql-tools/graphql-file-loader)	16.8.1 → 17.0.2 (8.2.7 → 9.0.33, 7.8.14 → 8.1.15, 7.5.17 → 8.1.18)	prod/dev	–
express-jwt (+jwks-rsa)	6.1.2 → 8.5.1 (2.0.5 → 4.1.0)	dev	backend/helpers.ts
express-validator	6.15.0 → 7.3.2	dev	backend/validators.ts
eslint (+@eslint/js)	^9.38.0 → ^10.8.0	dev	backend/graphql/resolvers/Query.ts
fuse.js	6.5.3 → 7.5.0	dev	backend/database.ts
@testing-library/react (+jest-dom, new @testing-library/dom)	^14.0.0 → ^16.3.2, ^5.16.5 → ^7.0.0	dev	src/setup-tests.js
@cypress/code-coverage	^3.14.5 → ^4.0.3	dev	–
eslint-plugin-cypress	^5.2.0 → ^6.4.3	dev	–
bcryptjs	2.4.3 → 3.0.3	dev	–
concurrently	9.1.2 → 10.0.4	dev	–
connect-history-api-fallback	1.6.0 → 2.0.0	dev	–
cross-env	7.0.3 → 10.1.0	dev	–
dotenv	16.0.0 → 17.4.2	dev	–
http-proxy-middleware	0.19.1 → 3.0.7	dev	–
husky	7.0.4 → 9.1.7	dev	–
jsdom	^22.1.0 → ^29.1.1	dev	–
nodemon	2.0.22 → 3.1.14	dev	–
npm	^9.8.0 → ^11.18.0	dev	–
nyc	15.1.0 → 18.0.0	dev	–
patch-package	^7.0.0 → ^8.0.1	dev	–
start-server-and-test	1.14.0 → 3.0.11	dev	–
wait-on	^8.0.3 → ^9.1.0	dev	–
@types/bcryptjs 3, @types/jsonwebtoken 9, @types/jwt-decode 3, @types/node 26, @types/shortid 2, @types/uuid 11, @types/yup 0.32	type-only	dev	–

Security fixes

npm audit needs an npm lockfile (ENOLOCK here), so advisories were taken from yarn audit. Upgrades in this PR pull in the fixed versions of, among others:

• axios 0.28.1 → 1.18.1 (SSRF / credential-leak and DoS advisories affecting 0.x)
• http-proxy-middleware 0.19.1 → 3.0.7 (DoS advisories in 2.x and earlier)
• form-data, tar, shell-quote, fast-xml-parser, path-to-regexp and jsonwebtoken transitive advisories resolved via the @okta/*, graphql-tools, nyc, npm and aws-amplify upgrades
• remaining yarn audit findings are reachable only through the packages listed under Skipped below (chiefly lowdb 1, express 4 and the Vite 8 stack)

Skipped

Reverted after the attempt failed — each was tried on its own commit, validated, then reverted:

package	reason
@mui/material, @mui/icons-material, @mui/lab 5 → 9	Grid v2 no longer consumes container/item/justifyContent/alignItems, so those props leak to the DOM (React logs errors) across 19 files, and inputProps/InputProps must become slotProps.htmlInput/slotProps.input. Codemod-scale; also doubled the Cypress suite runtime (1m50s → 4m15s)
react, react-dom 18 → 19	MUI v5 peers only allow React 17/18, so it can only land together with the MUI migration above
react-router, react-router-dom 5 → 8/7	useRouteMatch and Switch are gone; requires rewriting every route and container
xstate, @xstate/react 4 → 5/6	Machine removed in favour of createMachine/actors; all 8 machines plus every useActor call site would need rewriting
typescript 5.8 → 7	drops baseUrl and moduleResolution: node10, which this repo's tsconfig relies on
lowdb 1 → 7	ESM-only, no default export, lowdb/adapters/FileSync removed — a full backend/database.ts rewrite
express 4 → 5 (+ @types/express 5)	handlers returning Response no longer typecheck (RequestHandler must return void); router/req.query semantics also changed
@faker-js/faker 6 → 10	faker.random.* and faker.helpers.randomize removed; seed scripts and tests would need broad rewrites
dinero.js 1 → 2	no default export; v2 has a completely different immutable API
history 4 → 5	react-router 5 pins history 4; v5 changed location/listener shapes and breaks routing
detect-port 1 → 2	ESM build imports debuglog from node:util, which Vite cannot externalize for the browser bundle
vite 8, vitest 4, @vitejs/plugin-react 6, vite-plugin-istanbul 9	Vite 8's rolldown-based config loader fails on this vite.config.ts; the plugins require Vite 8, so the whole group is blocked
@types/lodash 4.14.181 → 4.17.24	narrows sortBy/orderBy unions so scripts/seedDataUtils.ts no longer typechecks on `Transaction

Could not be installed on the repo's Node version (.nvmrc = 22.13.0) — each requires Node ≥ 22.15/22.18/22.22, so bumping them means bumping .nvmrc and engines first:

@babel/core 8, @babel/plugin-syntax-flow 8, @babel/plugin-transform-react-jsx 8, @babel/preset-env 8, http-proxy-middleware 4, jsdom 30, npm 12, plus @types/detect-port 2, @types/dinero.js 2, @types/express-serve-static-core 5, @types/http-proxy-middleware 1 and @types/lowdb 2, which are pinned to the runtime packages skipped above.

Source impact

Production dependencies touched by source changes: react-number-format (TransactionCreateStepTwo.tsx). Backend dev dependencies touched: express-jwt/jwks-rsa (backend/helpers.ts), express-validator (backend/validators.ts), fuse.js (backend/database.ts), passport (backend/auth.ts), eslint (backend/graphql/resolvers/Query.ts), @testing-library/* (src/setup-tests.js). Everything else is dev-only tooling (Cypress, Percy, nyc, husky, babel, types) or a drop-in runtime upgrade with no call-site changes.

Validation

Run on 1f9cbbe with Node 22.13.0 / yarn 1.22.22:

gate	result
yarn types (tsc --noEmit)	pass
yarn lint (eslint + prettier)	pass
yarn build (vite build)	pass
yarn test:unit:ci (vitest)	44 passed, 10 skipped
yarn db:seed	pass
yarn cypress:run (full E2E)	111/111 passing, 21 specs

Video demo

35s annotated walkthrough of the running app (sign-up → onboarding → feeds → search → payment → settings), plus the full manual test matrix and console check:

Two issues surfaced during the walkthrough are pre-existing on develop (verified by A/B against an unmodified develop worktree) and are documented in the walkthrough comment: an invisible onboarding Dialog root that swallows clicks for users who already have a bank account, and payment amounts truncating cents ($12.34 → $12.00).

Link to Devin session: https://app.devin.ai/sessions/65278c6eca294188a1d9569f914f4175
Requested by: @dr-phil

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Frontend walkthrough verified (manual UI testing @ 1f9cbbe)

App run locally (Vite :3000 + backend :3001) and driven entirely through the browser UI. 35s annotated recording:

Results

Flow	Result
Sign up / logout / sign in (passport 0.7 async logout)	pass
Major UI sections: side nav, header, balance, feed tabs, public feed	pass
Feed tab switching Everyone / Friends / Mine	pass
Recipient search filters list (fuse.js 7)	pass
Clearing search empties the list (fuse.js 7 guard in backend/database.ts)	pass
NumericFormat amount renders $12.34 (react-number-format 5)	pass
Payment → confirmation → Mine feed → bank withdrawal	pass
Bank Accounts + Notifications navigation	pass
User settings validation + save (MUI v5 inputProps restored)	pass
Console: MUI Grid DOM prop-leak errors gone	pass

The differentiating check for the fuse.js 7 guard — clearing the query yields zero rows instead of all users:

Console check after the full session

3 Errors — all pre-existing, code identical to develop:
  Invalid DOM property `stop-color` / `stop-opacity`   (SvgCypressLogo.tsx, src/svgs/*.svg)
  A component is changing an uncontrolled input to be controlled  (user settings form)
Warnings: XState 4 "Empty string transition configs" deprecation

The MUI 9 justifyContent / alignItems / borderColor Grid prop-leak errors seen on the earlier MUI 9 revision are gone after the MUI 5 / React 18 revert.

Two pre-existing issues found (NOT caused by this PR)

1. Invisible onboarding Dialog swallows all clicks after signing in as a user who already has a bank account: .MuiModal-root stays mounted full-viewport, document.elementFromPoint() returns data-test="user-onboarding-dialog", and no pointer/keyboard events reach the app. Verified to reproduce identically on unmodified develop (MUI 5.16.12 / React 18.2.0). Source: src/containers/UserOnboardingContainer.tsx. Workaround for this walkthrough: signed up a fresh user and completed onboarding through the UI, which unmounts the dialog cleanly.
2. Payment amounts truncate cents — $12.34 is stored as 1200 (= $12.00), from body("amount").isNumeric().trim().toInt() in backend/validators.ts (unchanged vs develop).

Both deserve their own issues; neither blocks this PR.