chore(deps): upgrade all dependencies (2026-08-17)

[devin-ai-integration]

Summary

Upgrades every outdated npm dependency in the dashboard (28 packages) in batched commits: patch, minor, then one commit per major. No application source changes were needed — every upgrade was accepted only after npm run lint, npm run build, and npx tsc --noEmit passed. npm audit goes from 14 vulnerabilities (1 critical, 10 high) → 0.

The notable moves are vite 6 → 8 (rolldown-based build) and typescript 5.7 → 6.0, both of which required coupling decisions documented below. React 19 peer-dependency overrides are preserved unchanged.

Upgrade summary

Batch 1 — patch (chore(deps): upgrade patch dependencies)

Package	Old	New
eslint	9.39.1	9.39.5
@eslint/js	9.39.1	9.39.5
postcss	8.5.6	8.5.26
@fullcalendar/core, react, daygrid, timegrid, list, interaction	6.1.15	6.1.21

Batch 2 — minor (chore(deps): upgrade minor dependencies)

Package	Old	New
react	19.0.0	19.2.8
react-dom	19.0.0	19.2.8
@types/react	19.0.12	19.2.18
@types/react-dom	19.0.4	19.2.4
tailwindcss	4.0.8	4.3.3
@tailwindcss/postcss	4.0.8	4.3.3
react-router	7.9.5	7.18.2
tailwind-merge	3.0.1	3.6.0
typescript-eslint	8.24.0	8.67.0
eslint-plugin-react-hooks	5.1.0	5.2.0

Batch 3 — majors, one commit each

Package	Old	New	Notes
globals	15.15.0	17.11.0
eslint-plugin-react-refresh	0.4.19	0.5.4
typescript	5.7.3	6.0.3	~ pin preserved (~6.0.3); TS 7 skipped, see below
vite	6.4.1	7.3.6	initially taken to 8.2.1 (coupled with the two plugins below, since vite 8 fails to build with @vitejs/plugin-react 4.x: Cannot find package 'esbuild'), then pinned back to 7.3.6 — see "vite 8 regression" below
@vitejs/plugin-react	4.3.4	5.2.0	6.x skipped, see below
vite-plugin-svgr	4.3.0	5.2.0
apexcharts	4.4.0	6.9.0	coupled with react-apexcharts in one commit
react-apexcharts	1.7.0	2.1.1
swiper	11.2.3	14.1.0
react-dropzone	14.3.5	20.1.0
react-helmet-async	2.0.5	3.0.0	now declares React 19 support natively; override left in place

vite 8 regression (why vite is pinned to 7.3.6)

vite 8.2.1 passes lint, npm run build and tsc --noEmit, but the app is broken at runtime — in dev and in the production build:

#root innerHTML length: 0
Uncaught TypeError: _node_modules_css_loader_dist_runtime_api_js__WEBPACK_IMPORTED_MODULE_1___default(...) is not a function

The failure comes from @react-jvectormap/core (used by src/components/ecommerce/CountryMap.tsx), which ships a webpack bundle that requires css-loader/dist/runtime/api.js; vite 8's rolldown-based CJS interop resolves that default import to a namespace instead of a function, so the whole React tree fails to mount and the dashboard renders blank. main (vite 6.4.1) renders fine, so this is caused by the upgrade. Working around it would mean patching or replacing @react-jvectormap — out of scope here — so vite is pinned to the latest 7.x (7.3.6), which is still a major upgrade and renders correctly (#root ≈ 252k chars, no console errors). @vitejs/plugin-react 5.2.0 and vite-plugin-svgr 5.2.0 both peer-support vite 7.

Note for anyone bisecting: clear node_modules/.vite after changing vite versions, or stale vite-8 prebundles reproduce the error under vite 7.

A final commit runs npm audit fix (non-breaking, lockfile-only) to clear two remaining transitive advisories (flatted, yaml).

Security fixes

npm audit before: 14 vulnerabilities (1 critical, 10 high, 2 moderate, 1 low). After: 0. Advisories resolved include:

• brace-expansion — GHSA-f886-m6hf-6m8v, GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895
• minimatch — GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74
• picomatch — GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
• postcss — GHSA-qx2v-qp2m-jg93, GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
• vite — GHSA-4w7w-66w2-5vf9, GHSA-p9ff-h696-f583, GHSA-fx2h-pf6j-xcff
• js-yaml — GHSA-mh29-5h37-fv8m, GHSA-h67p-54hq-rp68, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
• nanoid — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
• flatted — GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
• yaml — GHSA-48c2-rrv3-qjmp
• ajv — GHSA-2g4f-4pwh-qvx6, @babel/core — GHSA-4x5r-pxfx-6jf8, launch-editor — GHSA-v6wh-96g9-6wx3

npm audit fix --force was not used.

Skipped packages

Package	Target	Reason
@fullcalendar/core, @fullcalendar/react	7.0.2	The plugin packages (daygrid, timegrid, list, interaction) have no stable 7.x release (latest published is 7.0.0-rc.0/7.0.0-beta.6), so the FullCalendar set cannot move to 7 as a unit. All six pinned to 6.1.21 instead.
typescript	7.0.2	typescript-eslint hard-errors on load: "typescript-eslint does not support TS 7.0" (upstream tracking issue typescript-eslint#10940), so npm run lint fails. Took TS 6.0.3 instead, which passes lint, build and tsc --noEmit.
@vitejs/plugin-react	6.0.5	npm install fails with ERESOLVE — its optional peer @rolldown/plugin-babel@0.2.3 pulls a conflicting @babel/core@8.0.0-rc.4. Resolving would require an overrides entry pinning a prerelease Babel. 5.2.0 peer-supports `vite ^7
eslint-plugin-react-hooks	7.1.1	v7's new rules (react-hooks/set-state-in-effect, react-hooks/purity) produce 4 lint errors in existing app source (SidebarContext.tsx, ThemeContext.tsx, Calendar.tsx:38, Calendar.tsx:97 Date.now() in render). Fixing requires refactoring application components, which is out of scope for a dependency upgrade. Took the in-range 5.2.0.

Source impact

• Used in src/: react, react-dom, react-router (16 files), apexcharts + react-apexcharts (5 files), flatpickr (2), @fullcalendar/*, swiper, react-dropzone, react-helmet-async, @react-jvectormap/*, clsx, tailwind-merge (1 file each), tailwindcss via src/index.css.
• Dev-only / build tooling: vite, @vitejs/plugin-react, vite-plugin-svgr, typescript, eslint, @eslint/js, typescript-eslint, eslint-plugin-react-hooks, eslint-plugin-react-refresh, globals, postcss, @tailwindcss/postcss, @types/react, @types/react-dom.
• react-dnd / react-dnd-html5-backend are declared but not imported anywhere in src/ (and were already current).

Validation

Gate	Result
npm run lint	pass — 0 errors, 2 pre-existing react-refresh/only-export-components warnings (identical on main)
npm run build (tsc -b && vite build)	pass
npx tsc --noEmit	pass
npm test	no test script exists in this repo — there is no unit-test suite to run; tests/ contains only Python Selenium/Playwright browser scripts that are not wired to npm
npm audit	0 vulnerabilities

Baseline on main was verified green (lint/build/tsc) before any upgrade. All three gates were re-run after every batch and after every individual major upgrade.

Frontend verification

Verified end-to-end in a real browser against npm run dev (vite 7.3.6) with a recorded, annotated walkthrough: all checks passed, 0 console errors, 0 console warnings. Dashboard render, Tailwind 4.3 styling, ApexCharts 6 widgets (bars + live tooltip, radial 75.55%, area series), the jVectorMap demographic map (176 country paths), react-router 7.18 navigation across Calendar / Basic Tables / Profile / Alerts / Line & Bar Chart, FullCalendar day-select → add-event, dark-mode toggle, sidebar collapse, Ctrl+K search, react-dropzone onDrop, and the flatpickr picker.

swiper 11 → 14 could not be exercised as a carousel: the free template imports only swiper/swiper-bundle.css and has no Swiper React component in src/. Verified the CSS entry still resolves (78 .swiper* rules loaded).

Link to Devin session: https://app.devin.ai/sessions/880e22ef0447491eb0368970cfd9a9b8
Requested by: @dr-phil

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring