chore(deps): upgrade all dependencies (2026-08-10)

[devin-ai-integration]

Summary

Upgrades every outdated npm dependency (29 packages) to its newest working version, in one commit per batch (patch → minor → one commit per major). npm audit goes from 14 vulnerabilities (1 critical, 10 high) to 0.

Two upgrades are deliberately not taken to latest, because build/lint/typecheck are not sufficient gates here:

• vite is pinned to ^7.3.6, not 8.x. With vite@8 (rolldown) the app builds, lints and typechecks cleanly but renders a 100% blank page on every route in dev and in the production bundle: @react-jvectormap/core ships a webpack-prebundled dist whose css-loader runtime throws at module-init time, aborting the graph before createRoot().render() in src/main.tsx runs.

  TypeError: _node_modules_css_loader_dist_runtime_api_js__WEBPACK_IMPORTED_MODULE_1___default(...) is not a function
   > ./src/components/MapContainer/styles.module.scss  node_modules/@react-jvectormap/core/dist/index.js:292
  

  Vite 8 also emitted a matching Use of direct \eval`rolldown warning on that same file. Vite 7 is unaffected. Moving to Vite 8 requires replacing or patching@react-jvectormap`.
• typescript is on ~6.0.3, not 7.0.2: typescript-eslint hard-errors on TS 7 (typescript-eslint does not support TS 7.0, tracking issue), so npm run lint cannot run at all.

react-helmet-async@3 declares React 19 support, so its overrides entry is dropped; the @react-jvectormap/* overrides are still required (they still peer-declare react@^16.8 || ^17 || ^18).

Version-range style is preserved: caret everywhere, tilde for typescript.

Upgrades

Patch

Package	Old	New
@eslint/js (dev)	9.39.1	9.39.5
eslint (dev)	9.39.1	9.39.5
postcss (dev)	8.5.6	8.5.26
@fullcalendar/core daygrid interaction list react timegrid (prod)	6.1.15	6.1.21

Minor

Package	Old	New
react (prod)	19.0.0	19.2.8
react-dom (prod)	19.0.0	19.2.8
react-router (prod)	7.9.5	7.18.2
tailwind-merge (prod)	3.0.1	3.6.0
tailwindcss (dev)	4.0.8	4.3.3
@tailwindcss/postcss (dev)	4.0.8	4.3.3
@types/react (dev)	19.0.12	19.2.18
@types/react-dom (dev)	19.0.4	19.2.4
typescript-eslint (dev)	8.24.0	8.66.0
eslint-plugin-react-hooks (dev)	5.1.0	5.2.0

Major

Package	Old	New	Notes
apexcharts (prod)	4.4.0	6.8.0	upgraded as a unit with react-apexcharts
react-apexcharts (prod)	1.7.0	2.1.1
swiper (prod)	11.2.3	14.1.0	fixes the critical advisory; CSS-only usage in this repo
react-dropzone (prod)	14.3.5	20.1.0	useDropzone API unchanged for our usage
react-helmet-async (prod)	2.0.5	3.0.0	override removed
vite (dev)	6.4.1	7.3.6	not 8.x — see Summary
@vitejs/plugin-react (dev)	4.3.4	5.2.0	not 6.x — 6.x pulls @rolldown/plugin-babel, which peer-requires @babel/core@8.0.0-rc, an unresolvable prerelease conflict
vite-plugin-svgr (dev)	4.3.0	5.2.0
globals (dev)	15.15.0	17.9.0
eslint-plugin-react-refresh (dev)	0.4.19	0.5.4
typescript (dev)	5.7.3	6.0.3	not 7.x — see Summary

Skipped

Package	Target	Reason
vite	8.2.1	blank page at runtime via @react-jvectormap/core (details + stack in Summary). Needs that dep replaced/patched first.
typescript	7.0.2	typescript-eslint refuses to load under TS 7, breaking npm run lint.
@vitejs/plugin-react	6.0.5	ERESOLVE: transitively peer-requires @babel/core@8.0.0-rc.4.
eslint-plugin-react-hooks	7.1.1	v7 enables the react-compiler rules, producing 4 new errors in existing source (set-state-in-effect in ThemeContext.tsx, AppSidebar.tsx, Calendar.tsx; purity for Date.now() in Calendar.tsx). Fixing them means refactoring app code, which is out of scope for a deps PR.
@fullcalendar/*	7.0.2	only core and react have a stable 7.x; daygrid/timegrid/list/interaction top out at 7.0.0-rc.0. FullCalendar must move as a coupled unit, so all stay on 6.1.21.

Security fixes

npm audit: 14 vulnerabilities (1 critical, 10 high, 2 moderate, 1 low) → 0.

Advisory	Package	Severity
GHSA-hmx5-qpq5-p643	swiper — prototype pollution	critical
GHSA-4w7w-66w2-5vf9, GHSA-p9ff-h696-f583, GHSA-fx2h-pf6j-xcff	vite — path traversal, arbitrary file read via dev-server WS, server.fs.deny bypass	high
GHSA-v6wh-96g9-6wx3	launch-editor (transitive) — NTLMv2 hash disclosure	high
GHSA-mw96-cpmx-2vgc	rollup (transitive) — arbitrary file write via path traversal	high
GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh	flatted (transitive) — recursion DoS, prototype pollution	high
GHSA-chx6-hx7r-mcp5, GHSA-2j2x-hqr9-3h42	react-router — DoS via route matching, open redirect via protocol-relative URL	moderate/low
GHSA-48c2-rrv3-qjmp	yaml (transitive) — stack overflow	moderate

The transitive fixes came from npm audit fix (lockfile only, no --force).

Source impact

Actively imported in src/: react, react-dom, react-router, @fullcalendar/* (pages/Calendar.tsx), apexcharts/react-apexcharts (all chart widgets), react-dropzone (components/form/form-elements/DropZone.tsx), react-helmet-async (components/common/PageMeta.tsx), tailwind-merge, clsx, @react-jvectormap/* (components/ecommerce/CountryMap.tsx).

swiper is CSS-only here — src/main.tsx imports swiper/swiper-bundle.css and src/index.css styles .swiper-*, but no Swiper component exists in src/. So 11→14 has no runtime surface in this app and is not exercised by the walkthrough below.

Dev-only: eslint + plugins, typescript, typescript-eslint, vite + plugins, tailwindcss/@tailwindcss/postcss, postcss, globals, @types/*.

Validation

• npm run build — pass
• npm run lint — pass (2 pre-existing react-refresh/only-export-components warnings, unchanged from main)
• npx tsc --noEmit — pass
• npm audit — 0 vulnerabilities
• No npm test script exists in this repo (the tests/ directory holds a standalone Python/Selenium harness), so there is no unit-test gate to run; runtime correctness is covered by the recorded walkthrough instead.
• Production bundle smoke-checked via vite preview: #root renders 254661 chars, 0 page errors.
• Each batch was validated (build + lint + tsc) before being committed.

Video demo

Recorded walkthrough of the upgraded app on the dev server (Vite 7.3.6) — all executed assertions passed, 0 console errors/warnings for the whole session. Dashboard with all three ApexCharts 6 widgets and the jvectormap world map (the exact path that was blank under Vite 8), dark-mode and sidebar-collapse toggles, navigation to Calendar / Forms / Tables / Line Chart / Bar Chart / Alerts / Profile, FullCalendar event create + re-open as "Edit Event", form input/select/checkbox, react-dropzone@20 onDrop actually firing (Files dropped: Array(1)), and ApexCharts tooltips on hover.

Link to Devin session: https://app.devin.ai/sessions/d648dd645469479babd18b1728332b8b
Requested by: @dr-phil

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring