chore(deps): upgrade all dependencies (2026-07-20)

[devin-ai-integration]

Summary

Upgrades all outdated npm dependencies in a single PR, batched by risk (patch → minor → major) with each batch validated by npm run build, npm run lint, and npx tsc --noEmit. Commits are separated per batch so any change is easy to revert.

Headline outcome: npm audit goes from 13 vulnerabilities (1 critical, 6 high, 5 moderate, 1 low) → 0, including the critical Swiper prototype-pollution and the React Router XSS/redirect/RCE advisory cluster. The repo's caret pinning convention (tilde for typescript) and the React 19 peer-dependency overrides are preserved.

Four major upgrades were skipped (documented below) because they require source refactoring or hit unresolvable peer conflicts; in each case the safe in-range upgrade was applied instead.

Patch upgrades

Package	Old	New
@eslint/js	9.39.1	9.39.5
eslint	9.39.1	9.39.5
postcss	8.5.6	8.5.20

Minor upgrades

Package	Old	New
react	19.0.0	19.2.7
react-dom	19.0.0	19.2.7
@types/react	19.0.12	19.2.17
@types/react-dom	19.0.4	19.2.3
tailwindcss	4.0.8	4.3.3
@tailwindcss/postcss	4.0.8	4.3.3
react-router	7.9.5	7.18.1
tailwind-merge	3.0.1	3.6.0
typescript-eslint	8.24.0	8.64.0
eslint-plugin-react-refresh	0.4.19	0.5.3
eslint-plugin-react-hooks	5.1.0	5.2.0

Major / coupled-unit upgrades

Package	Old	New	Notes
@fullcalendar/core	6.1.15	6.1.21	upgraded as a unit
@fullcalendar/daygrid	6.1.15	6.1.21
@fullcalendar/interaction	6.1.15	6.1.21
@fullcalendar/list	6.1.15	6.1.21
@fullcalendar/react	6.1.15	6.1.21
@fullcalendar/timegrid	6.1.15	6.1.21
apexcharts	4.4.0	6.3.0	with react-apexcharts (unit)
react-apexcharts	1.7.0	2.1.1
swiper	11.2.3	14.0.5	resolves critical GHSA-hmx5-qpq5-p643
react-dropzone	14.3.5	19.1.1
react-helmet-async	2.0.5	3.0.0
globals	15.15.0	17.7.0
vite	6.4.1	6.4.3	resolves vite advisories (see below)
@vitejs/plugin-react	4.3.4	4.7.0
vite-plugin-svgr	4.3.0	4.5.0

Security fixes

npm audit: 13 → 0. Resolved advisories include:

• swiper — Prototype pollution, critical (GHSA-hmx5-qpq5-p643)
• react-router — XSS via open redirects, SSR XSS in ScrollRestoration, turbo-stream RCE, DoS, CSRF cluster (GHSA-2w69-qvjg-hvjx, GHSA-8v8x-cx79-35w7, GHSA-49rj-9fvp-4h2h, GHSA-8x6r-g9mw-2r78, GHSA-rxv8-25v2-qmq8, and more)
• vite — Arbitrary file read via dev-server WebSocket & server.fs.deny bypass (GHSA-p9ff-h696-f583, GHSA-fx2h-pf6j-xcff)
• rollup — Arbitrary file write via path traversal (GHSA-mw96-cpmx-2vgc)
• postcss — XSS via unescaped </style> (GHSA-qx2v-qp2m-jg93)
• flatted (GHSA-25h7-pfq9-p65f), yaml, brace-expansion, minimatch, picomatch, js-yaml, ajv, @babel/core

The 3 transitive advisories remaining after the direct-dep upgrades (flatted, rollup, yaml) were closed with npm audit fix (non---force) in a dedicated commit.

Skipped packages

Package	Latest	Reason
typescript	7.0.2	typescript-eslint@8.64.0 peer requires typescript >=4.8.4 <6.1.0; TS 7 is unsupported by the linter and would break npm run lint. Kept at 5.7.3 (matches tilde ~5.7.2).
@fullcalendar/core, @fullcalendar/react	7.0.1	The plugin packages (daygrid/interaction/list/timegrid) are only published up to 6.1.21. FullCalendar requires all packages on the same version, so the coupled family was kept at 6.1.21.
@vitejs/plugin-react	6.0.3	Pulls @rolldown/plugin-babel whose peer @babel/core ^8.0.0-rc.1 conflicts with the resolved 8.0.0-rc.4 (ERESOLVE, would need --legacy-peer-deps). Applied safe 4.7.0.
vite	8.1.5	Blocked by the @vitejs/plugin-react@6 peer conflict above. Applied 6.4.3, which already fixes the vite CVEs.
vite-plugin-svgr	5.2.0	v5 pairs with the vite-8/plugin-react-6 stack; applied 4.5.0.
eslint-plugin-react-hooks	7.1.1	v7's recommended config enables new rules (react-hooks/set-state-in-effect, react-hooks/purity) that flag existing source as 4 errors in ThemeContext, AppSidebar, Calendar. Fixing requires effect/render refactoring beyond a dependency bump. Applied 5.2.0.

Source impact

• Actively imported in src/: react, react-dom, react-router, @fullcalendar/* (Calendar.tsx), apexcharts + react-apexcharts (dashboard & chart pages), react-dropzone (DropZone.tsx), react-helmet-async (PageMeta.tsx), swiper (CSS bundle only in main.tsx/index.css), tailwind-merge, clsx.
• Dev / build-only: eslint + plugins, typescript-eslint, @eslint/js, globals, vite, @vitejs/plugin-react, vite-plugin-svgr, tailwindcss, @tailwindcss/postcss, postcss, @types/*.

Validation results

• npm run build — ✅ passes
• npm run lint — ✅ 0 errors (2 pre-existing react-refresh/only-export-components warnings, unchanged from baseline)
• npx tsc --noEmit — ✅ clean
• npm audit — ✅ 0 vulnerabilities

Video demo

Recorded walkthrough of the upgraded frontend (all 5 tests passed: home load, UI sections, navigation, interactive form + Flatpickr date picker, dark-mode toggle, no console errors):

Link to Devin session: https://app.devin.ai/sessions/4547c7c17e044b5695b694710faefd13
Requested by: @dr-phil

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring