chore(deps): upgrade all dependencies (2026-07-13)

[devin-ai-integration]

Summary

Upgrades all outdated npm dependencies in TailAdmin React, following the "Upgrade All Dependencies" playbook (batched patch → minor → major, validating npm run build + npm run lint after each batch, one commit per batch/major). Resolves all 13 npm audit advisories (1 critical, 6 high, 5 moderate, 1 low) → 0 vulnerabilities. Frontend was visually verified in a real browser with a 60s recorded walkthrough and zero console errors.

The repo's version-prefix convention is preserved: caret ^ everywhere except typescript which stays tilde ~.

3 major bumps were intentionally skipped (details below) because they break the build/lint/runtime and fixing them would require refactoring app source or pulling prerelease deps — out of scope for a dependency bump.

Upgraded packages

Patch (chore(deps): upgrade patch dependencies)

Package	From	To
@eslint/js	9.39.1	9.39.5
eslint	9.39.1	9.39.5
postcss	8.5.6	8.5.19
@fullcalendar/core, daygrid, interaction, list, react, timegrid	6.1.15	6.1.21

Minor (chore(deps): upgrade minor dependencies)

Package	From	To
react	19.0.0	19.2.7
react-dom	19.0.0	19.2.7
@types/react	19.0.12	19.2.17
@types/react-dom	19.0.4	19.2.3
react-router	7.9.5	7.18.1
tailwindcss	4.0.8	4.3.2
@tailwindcss/postcss	4.0.8	4.3.2
tailwind-merge	3.0.1	3.6.0
typescript-eslint	8.24.0	8.63.0
eslint-plugin-react-refresh	0.4.19	0.5.3

Major (one commit each)

Package	From	To	Notes
@vitejs/plugin-react	4.3.4	5.2.0	coupled with vite; 5.2 supports vite 6
vite-plugin-svgr	4.3.0	5.2.0	coupled with vite
apexcharts	4.4.0	5.16.0	coupled with react-apexcharts
react-apexcharts	1.7.0	2.1.1	requires apexcharts >=5.10
swiper	11.2.3	14.0.5	resolves critical prototype-pollution CVE
react-dropzone	14.3.5	17.0.0
react-helmet-async	2.0.5	3.0.0
globals	15.15.0	17.7.0
eslint-plugin-react-hooks	5.1.0	5.2.0	7.x skipped (see below)
typescript	5.7.3	6.0.3	7.x skipped (see below); tilde ~ preserved
vite	6.4.1	6.4.3	7.x/8.x skipped (see below); still clears the vite advisory

Security fixes (npm audit: 13 → 0)

• critical — swiper prototype pollution → swiper 14
• high — react-router XSS / open-redirect / SSR RCE cluster → react-router 7.18.1
• high — vite path-traversal / arbitrary-file-read → vite 6.4.3
• high — rollup path traversal, minimatch/picomatch ReDoS → transitively resolved
• high — flatted unbounded-recursion DoS → npm audit fix
• moderate — postcss </style> XSS → postcss 8.5.19
• moderate — yaml stack-overflow DoS → npm audit fix
• moderate/low — ajv, js-yaml, brace-expansion, @babel/core → transitively resolved

Skipped major upgrades (documented, not silent)

Package	Latest	Kept at	Reason
vite	8.1.4	6.4.3	vite 7 and 8 break @react-jvectormap/core at runtime — its webpack-bundled dist references the css-loader runtime, and vite 7+'s esbuild CJS-interop change makes the default export non-callable (_..._css_loader_..._default(...) is not a function), crashing the whole app to a blank page. optimizeDeps.exclude did not help. jvectormap is a React-19-forced-override dep (see overrides) that ships a prebuilt bundle, so it can't be upgraded to fix this. Verified in-browser at the vite-8 commit. vite 6.4.3 still clears the vite security advisory.
@vitejs/plugin-react	6.0.3	5.2.0	6.x requires prerelease @babel/core@8.0.0-rc via @rolldown/plugin-babel (only needed by vite 8); pulling a prerelease core violates supply-chain safety. 5.2.0 is a real major bump (4→5) and works with vite 6.
eslint-plugin-react-hooks	7.1.1	5.2.0	v7's recommended config enables the React Compiler rules (react-hooks/purity, setState-in-effect) which flag 4 preexisting violations in ThemeContext, AppSidebar, Calendar → npm run lint fails. Fixing requires refactoring app source, out of scope.
typescript	7.0.2	6.0.3	TS 7 is the native (Go) rewrite; typescript-eslint@8.63 only supports >=4.8.4 <6.1.0, so TS 7 crashes eslint. 6.0.3 is the latest supported and still a major bump (5→6).

Source impact

Actively imported in src/: react, react-dom, react-router, apexcharts + react-apexcharts (charts), @fullcalendar/* (Calendar), react-dropzone (DropZone), react-helmet-async (PageMeta), tailwind-merge, clsx. swiper is referenced only via CSS class names (no JS import). The rest are dev/build-only (vite, eslint, typescript, tailwind tooling, @types/*).

Validation

• npm run build (tsc -b && vite build) — passes
• npm run lint — passes (0 errors, 2 preexisting react-refresh warnings, unchanged from baseline)
• npm audit — 0 vulnerabilities
• Frontend verified in-browser (no console errors) across Dashboard, Calendar, Form Elements, Basic Tables, Line/Bar charts, User Profile, dark-mode toggle.

Video demo

60s interactive walkthrough of the upgraded app (dashboard KPIs + ApexCharts, sidebar nav, calendar, forms, tables, charts, profile, dark mode) — zero console errors:
upgrade-demo.mp4

Link to Devin session: https://app.devin.ai/sessions/8d9b21c593344cea9141145ccf4f81cb
Requested by: @dr-phil

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Frontend recording

Watch the upgraded dashboard walkthrough