chore(deps): upgrade all dependencies (2026-08-03)

[devin-ai-integration]

Summary

Upgrades every outdated npm dependency in the template, batched patch → minor → major (one commit per major) so any single upgrade can be reverted in isolation. Baseline on main was green (npm run build, npm run lint, npx tsc --noEmit) and remains green after every batch.

Two upgrades needed more than a version bump:

• vite 6 → 7.3.6, not 8 (with @vitejs/plugin-react 4 → 5.2.0). Vite 8 was attempted first (commit dc55f8f) and broke the app at runtime while the build still exited 0: vite 8's rolldown dep-optimizer mis-handles the webpack/css-loader bundle shipped by @react-jvectormap/core, which throws _..._css_loader_..._WEBPACK_IMPORTED_MODULE_1___default(...) is not a function during module init. App.tsx statically imports Home → CountryMap → @react-jvectormap/core, so that throw blanks the entire React tree on every route, in dev and in the production preview. optimizeDeps.exclude: ['@react-jvectormap/core'] is not a fix either (it swaps the error for does not provide an export named 'VectorMap'), so commit 214ae23 pins vite to 7.x. vite.config.ts is unchanged. This is caught only by loading the app — see the verification comment on this PR.
  Note the vite commit also regenerated package-lock.json (hence its large diff): resolving the new plugin-react against the old lock, which still pinned @babel/core@7 as a transitive of plugin-react 4, failed with ERESOLVE.
• typescript 5.7 → 6.0.3, not 7.0.2. TS 7.0.2 builds and type-checks fine here, but typescript-eslint@8 hard-errors on it (typescript-eslint does not support TS 7.0, see typescript-eslint#10940), which breaks the lint gate. TS 6.0.3 is the newest version inside typescript-eslint's supported range (>=4.8.4 <6.1.0). Pinning convention ~ preserved for typescript; ^ everywhere else.

Coupled packages were upgraded together as units: react/react-dom/@types/react/@types/react-dom, tailwindcss/@tailwindcss/postcss, apexcharts/react-apexcharts, all @fullcalendar/*.

overrides (React 19 peer-dep shims) are left untouched, but two are now redundant and can be dropped in a follow-up: react-helmet-async@3 declares react: ^16.6 || ^17 || ^18 || ^19, and @react-jvectormap/world declares no peer deps at all. @react-jvectormap/core still caps at React 18, so its override is still required.

Upgrades

Patch

Package	From	To
eslint	9.39.1	9.39.5
@eslint/js	9.39.1	9.39.5
postcss	8.5.6	8.5.25
@fullcalendar/core	6.1.15	6.1.21
@fullcalendar/daygrid	6.1.15	6.1.21
@fullcalendar/interaction	6.1.15	6.1.21
@fullcalendar/list	6.1.15	6.1.21
@fullcalendar/react	6.1.15	6.1.21
@fullcalendar/timegrid	6.1.15	6.1.21

Minor

Package	From	To
react	19.0.0	19.2.8
react-dom	19.0.0	19.2.8
@types/react	19.0.12	19.2.18
@types/react-dom	19.0.4	19.2.4
tailwindcss	4.0.8	4.3.3
@tailwindcss/postcss	4.0.8	4.3.3
react-router	7.9.5	7.18.2
tailwind-merge	3.0.1	3.6.0
typescript-eslint	8.24.0	8.65.0

Major (one commit each)

Package	From	To
vite	6.4.1	7.3.6
@vitejs/plugin-react	4.3.4	5.2.0
vite-plugin-svgr	4.3.0	5.2.0
swiper	11.2.3	14.0.7
apexcharts	4.4.0	6.7.0
react-apexcharts	1.7.0	2.1.1
react-dropzone	14.3.5	20.0.0
react-helmet-async	2.0.5	3.0.0
eslint-plugin-react-refresh	0.4.19	0.5.3
globals	15.15.0	17.9.0
typescript	5.7.3	6.0.3

Security fixes

npm audit went from 13 vulnerabilities (1 critical, 9 high, 2 moderate, 1 low) to 1 high. Resolved:

Package	Severity	Advisories
swiper	critical	GHSA-hmx5-qpq5-p643
vite	high	GHSA-4w7w-66w2-5vf9, GHSA-p9ff-h696-f583, GHSA-v6wh-96g9-6wx3, GHSA-fx2h-pf6j-xcff
react-router	high	GHSA-2w69-qvjg-hvjx, GHSA-8v8x-cx79-35w7, GHSA-9jcx-v3wj-wh4m, GHSA-49rj-9fvp-4h2h, GHSA-2j2x-hqr9-3h42, GHSA-8646-j5j9-6r62, GHSA-f22v-gfqf-p8f3, GHSA-8x6r-g9mw-2r78, GHSA-rxv8-25v2-qmq8, GHSA-h5cw-625j-3rxh, GHSA-wrjc-x8rr-h8h6, GHSA-337j-9hxr-rhxg, GHSA-chx6-hx7r-mcp5
postcss	high	GHSA-qx2v-qp2m-jg93, GHSA-6g55-p6wh-862q, GHSA-r28c-9q8g-f849
rollup	high	GHSA-mw96-cpmx-2vgc
flatted	high	GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
js-yaml	high	GHSA-mh29-5h37-fv8m, GHSA-h67p-54hq-rp68, GHSA-52cp-r559-cp3m
minimatch	high	GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74
brace-expansion	high	GHSA-f886-m6hf-6m8v, GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg
picomatch	high	GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
ajv	moderate	GHSA-2g4f-4pwh-qvx6
yaml	moderate	GHSA-48c2-rrv3-qjmp
@babel/core	low	GHSA-4x5r-pxfx-6jf8

Remaining (unfixable by upgrade): react-router GHSA-qwww-vcr4-c8h2 (high) affects 7.12.0–8.2.0 with no forward fix published; npm audit fix --force would downgrade to 7.11.0, which reintroduces the 13 advisories above. The advisory is scoped to React Router's RSC mode, which this SPA does not use, so we stay on 7.18.2.

Skipped packages

Package	Latest	Reason
@fullcalendar/*	7.0.2	v7 folds the plugin packages into core: @fullcalendar/daygrid, timegrid, list, and interaction have no stable 7.x release (prerelease only). Moving to v7 means dropping those packages and rewriting src/pages/Calendar.tsx's plugin wiring — out of scope for a dependency bump. Upgraded to 6.1.21 instead.
eslint-plugin-react-hooks	7.1.1	v7 enables new rules (react-hooks/purity, set-state-in-effect) that turn 4 pre-existing app-code patterns into lint errors (Date.now() during render in Calendar.tsx; sync setState in effects in ThemeContext.tsx, AppSidebar.tsx, Calendar.tsx). Fixing those is an app-code refactor, and silencing the rules would defeat the upgrade. Left at 5.x (resolves to 5.2.0).
typescript	7.0.2	typescript-eslint@8 refuses to run against TS 7.0 (typescript-eslint#10940), breaking npm run lint. Upgraded to 6.0.3, the newest version in its supported range.
vite	8.2.0	Blanks the app at runtime via @react-jvectormap/core under rolldown (see Summary). Upgraded to 7.3.6, which still clears all four vite advisories. @vitejs/plugin-react@6 requires vite ^8, so it is capped at 5.2.0 to match.

Source impact

Actively imported in src/: react, react-dom, react-router, apexcharts + react-apexcharts (5 chart components), @fullcalendar/* (Calendar.tsx), react-dropzone (DropZone.tsx), react-helmet-async (PageMeta.tsx), tailwind-merge, @react-jvectormap/*, flatpickr, react-dnd.

swiper is not imported by any TS/TSX source — only its .swiper-button-* classes are styled in src/index.css — so the 11 → 14 jump carries no API risk here while clearing the critical advisory.

Dev-only (build/lint toolchain, no runtime impact): vite, @vitejs/plugin-react, vite-plugin-svgr, typescript, typescript-eslint, eslint, @eslint/js, eslint-plugin-react-refresh, globals, postcss, tailwindcss, @tailwindcss/postcss, @types/*.

Tailwind v4 config lives in src/index.css (no tailwind.config.js); the 4.0.8 → 4.3.3 bump required no config change and the CSS bundle still builds (116.7 kB → verified in the walkthrough below).

Validation

Run after every batch, all green:

Gate	Result
npm run build (tsc -b && vite build)	pass
npm run lint	pass — 0 errors, 2 warnings (both pre-existing on main: react-refresh/only-export-components in SidebarContext.tsx, ThemeContext.tsx)
npx tsc --noEmit	pass
npm test	no test script exists in this repo — nothing to run, not a failure

Runtime verification (not just a green build) was done on the upgraded app in dev and production preview: all 6 routes render with zero console errors — dashboard charts/map/table, calendar add-event modal, both chart pages, form controls (select, checkbox, radio, flatpickr, react-dropzone upload), tables, dark mode, and sidebar collapse.

Video demo

Full walkthrough recording and screenshots are in the verification comment on this PR: https://app.devin.ai/attachments/62b8c5ac-1a41-48e0-a99a-65c3633e650f/rec-a1bb4821-e2c1-453d-b5b2-3c3edd2e668c-edited.mp4

Link to Devin session: https://app.devin.ai/sessions/6490bc02b16f4e7b91cd64a87fb61852
Requested by: @dr-phil

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Runtime verification passed on 214ae23 (vite pinned to 7.3.6)

Re-tested locally on deps/upgrade-all-2026-08-03 @ 214ae23 in both npm run dev (vite 7.3.6) and the production npm run build + vite preview. The blank-page regression seen with vite 8 is gone — all 6 routes render with zero console errors or warnings.

Recording (full walkthrough): https://app.devin.ai/attachments/62b8c5ac-1a41-48e0-a99a-65c3633e650f/rec-a1bb4821-e2c1-453d-b5b2-3c3edd2e668c-edited.mp4

Verified working (dev + production preview)

• Dashboard /: metric cards (3,782 / 5,359), Monthly Sales bar, Monthly Target 75.55% radial, Statistics area chart, jVectorMap world map (the package that broke under vite 8), Recent Orders table.
• /line-chart + /bar-chart under apexcharts 6 / react-apexcharts 2, tooltips working.
• /calendar: FullCalendar 6.1.21 renders seeded events; Add Event modal creates a new event visible on Aug 20.
• /form-elements: text input, native select (Selected value: marketing), checkbox + radio, flatpickr popup date selection, and react-dropzone 20 upload logging Files dropped: Array(1).
• /basic-tables: 5 rows with avatars and status badges.
• Tailwind 4.3.3: dark-mode toggle and sidebar collapse/expand restyle correctly.
• npm run build exits 0, tsc --noEmit exits 0; the built bundle served by vite preview renders and is interactive.

Automated sweep of all 6 routes on dev and preview: non-empty #root on all 12 loads, ERRORS/WARNINGS: [].

Forms coverage (flatpickr / select / checkbox / radio / dropzone)

Tailwind 4.3.3 dark mode + sidebar collapse

Context: why vite 8 was dropped (previous run, 1e9bbf5)

With vite 8 / rolldown the app rendered nothing on every route (#root innerHTML length 0), in dev and in the production preview:

Uncaught TypeError: _node_modules_css_loader_dist_runtime_api_js__WEBPACK_IMPORTED_MODULE_1___default(...) is not a function
    at webpack://@react-jvectormap/core/./src/components/MapContainer/styles.module.scss

App.tsx statically imports Home → CountryMap → @react-jvectormap/core, so the module-init throw killed the whole React tree. npm run build exited 0 regardless, so a build-only CI gate would not catch it. optimizeDeps.exclude: ['@react-jvectormap/core'] is not a workaround either — it swaps the TypeError for does not provide an export named 'VectorMap'.

Non-blocking build warnings (pre-existing on main)

node_modules/@react-jvectormap/core/dist/index.js (…): Use of eval … is strongly discouraged  (many)
(!) Some chunks are larger than 500 kB after minification