chore(deps): upgrade all dependencies (2026-08-24)

[devin-ai-integration]

Summary

Upgrades every outdated npm dependency in this repo, batched into separate commits (patch → minor → one per major/coupled unit) so any single upgrade can be reverted independently. npm run lint, npx tsc --noEmit and npm run build pass after every batch and from a clean npm ci. There is no test script in this repo, so lint/tsc/build are the gates.

Only one non-dependency file changed: eslint.config.js. eslint-plugin-react-hooks@7 expanded its recommended set (set-state-in-effect, purity, …), which errors on existing source, so the config now names the two rules that were previously in effect instead of spreading the new recommended set:

-      ...reactHooks.configs.recommended.rules,
+      'react-hooks/rules-of-hooks': 'error',
+      'react-hooks/exhaustive-deps': 'warn',

Adopting the v7 recommended rules would require source refactoring across contexts/components and is left as follow-up.

The React 19 peer overrides block is preserved unchanged, caret pinning is retained everywhere, and typescript stays tilde-pinned per existing convention.

Upgrade summary

Patch — chore(deps): upgrade patch dependencies

Package	Old	New
eslint	^9.19.0	^9.39.5
@eslint/js	^9.19.0	^9.39.5
postcss	^8.5.2	^8.5.26

Minor — chore(deps): upgrade minor dependencies

Package	Old	New
react	^19.0.0	^19.2.8
react-dom	^19.0.0	^19.2.8
@types/react	^19.0.12	^19.2.18
@types/react-dom	^19.0.4	^19.2.5
tailwindcss	^4.0.8	^4.3.3
@tailwindcss/postcss	^4.0.8	^4.3.3
react-router	^7.1.5	^7.18.2
tailwind-merge	^3.0.1	^3.6.0
typescript-eslint	^8.22.0	^8.67.0
eslint-plugin-react-refresh	^0.4.18	^0.5.4

Majors (one commit each, coupled packages upgraded as a unit)

Commit	Package(s)	Old	New
chore(deps): upgrade @fullcalendar packages	@fullcalendar/core, daygrid, interaction, list, react, timegrid	^6.1.15	^6.1.21
chore(deps): upgrade swiper	swiper	^11.2.3	^14.1.0
chore(deps): upgrade vite and plugins + chore(deps): pin vite to 7.3.6	vite / @vitejs/plugin-react / vite-plugin-svgr	^6.1.0 / ^4.3.4 / ^4.3.0	^7.3.6 / ^5.2.0 / ^5.2.0
chore(deps): upgrade apexcharts and react-apexcharts	apexcharts / react-apexcharts	^4.1.0 / ^1.7.0	^6.10.0 / ^2.1.1
chore(deps): upgrade eslint-plugin-react-hooks	eslint-plugin-react-hooks	^5.0.0	^7.1.1
chore(deps): upgrade globals	globals	^15.14.0	^17.11.0
chore(deps): upgrade react-dropzone	react-dropzone	^14.3.5	^20.1.1
chore(deps): upgrade react-helmet-async	react-helmet-async	^2.0.5	^3.0.0

Note: @fullcalendar/core and @fullcalendar/react have a stable 7.0.2, but @fullcalendar/daygrid, interaction, list and timegrid publish no stable 7.x (highest is 7.0.0-rc.0). Since these must move as a unit, all six went to the highest common stable release, 6.1.21.

Security fixes

npm audit went from 1 critical / 10 high / 2 moderate / 1 low to a single transitive high. Resolved advisories include:

• swiper — critical GHSA-hmx5-qpq5-p643
• vite — GHSA-fx2h-pf6j-xcff, GHSA-p9ff-h696-f583 (high), GHSA-4w7w-66w2-5vf9, GHSA-v6wh-96g9-6wx3 (moderate)
• react-router — GHSA-2w69-qvjg-hvjx, GHSA-49rj-9fvp-4h2h, GHSA-8646-j5j9-6r62, GHSA-8v8x-cx79-35w7, GHSA-8x6r-g9mw-2r78, GHSA-chx6-hx7r-mcp5, GHSA-rxv8-25v2-qmq8 (high) plus 6 moderate
• postcss — GHSA-6g55-p6wh-862q, GHSA-r28c-9q8g-f849 (high), GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93 (moderate)
• transitive: rollup, nanoid, picomatch, minimatch, brace-expansion, js-yaml, ajv, yaml

Remaining after the upgrades: only flatted@3.3.2 (high — GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh), transitive through ESLint's flat-cache with no fixed version available. No direct dependency has an outstanding advisory (vite@7.3.6 and rollup@4.62.5 are both clean). npm audit fix --force was not used.

Skipped packages

Package	Target	Reason
typescript	~7.0.2	tsc --noEmit and build passed, but npm run lint fails hard: typescript-eslint@8.67.0 (latest) refuses TS 7.0 (typescript-eslint does not support TS 7.0). No published typescript-eslint supports TS 7 yet, so this needs to wait on upstream. Reverted to ~5.7.2.
@fullcalendar/* → 7.x	7.0.2	Not published as stable for four of the six packages (see note above).
vite (major)	^8.2.2	Vite 8 builds and type-checks fine but renders a blank page: @react-jvectormap/core ships a webpack-prebundled dist with inlined css-loader runtime, which Vite 8's Rolldown dep optimizer mis-handles (..._css_loader_dist_runtime_api_js__WEBPACK_IMPORTED_MODULE_1___default(...) is not a function), and the thrown error kills the entire React tree. Config workarounds were tried and rejected: optimizeDeps.exclude breaks resolution of the named VectorMap export, and optimizeDeps.include + needsInterop breaks on @react-jvectormap/world's named exports (core-only reproduces the original error). Settled on vite@^7.3.6 + @vitejs/plugin-react@^5.2.0, which is verified working. Vite 8 must wait on a fix in (or replacement of) @react-jvectormap/core.

Source impact

Actively imported in src/: react, react-dom, react-router, apexcharts + react-apexcharts (chart widgets), @fullcalendar/* (src/pages/Calendar.tsx), swiper (CSS-only usage), react-dropzone, react-helmet-async (PageMeta), tailwind-merge, tailwindcss. No source file required changes for any of these upgrades.

Dev/build-only: eslint + plugins/config, typescript-eslint, globals, postcss, @tailwindcss/postcss, vite, @vitejs/plugin-react, vite-plugin-svgr, @types/*. The ?react svgr transform and vite.config.ts continue to work on Vite 7 (unchanged config).

Validation

From a clean npm ci on the final branch state:

• npm run lint — exit 0 (2 preexisting react-refresh/only-export-components warnings in SidebarContext.tsx / ThemeContext.tsx)
• npx tsc --noEmit — exit 0
• npm run build — exit 0 (preexisting eval warning from @react-jvectormap/core, preexisting chunk-size warning)
• npm ci resolves cleanly (lockfile in sync)
• No test script exists in package.json; no tests were modified.

Runtime verification (the gates alone were not sufficient here)

Build success was actively misleading on this branch — the Vite 8 state passed lint/tsc/build while serving a blank page, in dev and in vite preview. So the app was loaded in a real browser on the final commit, with the real CountryMap.tsx (no stubs):

• Dashboard renders: #root 252,124 chars, 3 ApexCharts canvases, real jVectorMap with 176 country paths + 4 markers, Recent Orders 5 rows
• Pages: /, /calendar, /line-chart (6 series paths), /bar-chart (12 bars), /basic-tables, /profile, /alerts, /form-elements — all render
• FullCalendar 6.1.21: 42 day cells + 3 demo events, month→week switch, event click opens the edit modal prefilled
• Dark mode toggles (html.dark, body rgb(16,24,40)) and charts/map redraw; sidebar collapses 290px ↔ 90px; text input and react-dropzone 20 both work
• Zero console errors, page errors or failed requests, in dev and in the production vite preview build

Video demo

Link to Devin session: https://app.devin.ai/sessions/17aa38d28b5c46beb4c463c25d51f8d7
Requested by: @dr-phil

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring