chore(deps): upgrade all dependencies (2026-08-31)

[devin-ai-integration]

Summary

Upgrades every outdated npm dependency in the project (29 packages checked, 27 upgraded) and clears all 14 reported npm audit advisories — npm audit now reports 0 vulnerabilities. Commits are split by batch (patch → minor → one commit per major) so any single upgrade can be reverted in isolation.

Two upgrades were held back at a lower version than latest because of upstream incompatibilities, not because of app code: typescript stops at 6.0.3 (typescript-eslint hard-errors on the TS 7.0 API) and vite stops at 7.3.x (@vitejs/plugin-react@6 requires vite 8, but its optional peer @rolldown/plugin-babel pulls a prerelease @babel/core@8.0.0-rc.4 that npm refuses to resolve). No source file needed changing — no renamed APIs or import path changes were hit across swiper 11→14, apexcharts 4→7, react-dropzone 14→20, react-helmet-async 2→3 or vite-plugin-svgr 4→5. Version ranges keep the repo's existing convention (caret everywhere, tilde for typescript).

Upgrades

Patch

Package	Old	New
@eslint/js	9.39.1	9.39.5
eslint	9.39.1	9.39.5
postcss	8.5.6	8.5.26
@fullcalendar/core	6.1.15	6.1.21
@fullcalendar/daygrid	6.1.15	6.1.21
@fullcalendar/interaction	6.1.15	6.1.21
@fullcalendar/list	6.1.15	6.1.21
@fullcalendar/react	6.1.15	6.1.21
@fullcalendar/timegrid	6.1.15	6.1.21

Minor

Package	Old	New
react	19.0.0	19.2.8
react-dom	19.0.0	19.2.8
@types/react	19.0.12	19.2.18
@types/react-dom	19.0.4	19.2.5
react-router	7.9.5	7.18.3
tailwindcss	4.0.8	4.3.3
@tailwindcss/postcss	4.0.8	4.3.3
tailwind-merge	3.0.1	3.6.0
typescript-eslint	8.24.0	8.68.0
eslint-plugin-react-hooks	5.1.0	5.2.0

Major (one commit each)

Package	Old	New	Notes
swiper	11.2.3	14.2.0	fixes critical prototype pollution; only consumed as swiper/swiper-bundle.css in main.tsx, no component API surface used
vite + @vitejs/plugin-react	6.4.3 / 4.3.4	7.3.x / 5.2.0	coupled — plugin-react 5 peers on vite ^7; see skipped table for why not vite 8
vite-plugin-svgr	4.3.0	5.2.0	svgrOptions.namedExport config unchanged and still resolves ?react imports
apexcharts + react-apexcharts	4.4.0 / 1.7.0	7.1.0 / 2.1.1	coupled; ApexOptions objects in all 5 chart components type-check unchanged
eslint-plugin-react-refresh	0.4.19	0.5.5
globals	15.15.0	17.11.0
react-dropzone	14.3.5	20.1.1	useDropzone signature unchanged
react-helmet-async	2.0.5	3.0.0	HelmetProvider/Helmet usage in PageMeta unchanged; the React 19 peer override is now redundant but left in place
typescript	5.7.3	6.0.3

Transitive advisories (rollup, yaml, picomatch, flatted, esbuild) were resolved by a lockfile-only npm audit fix — --force was not used.

Security fixes

Advisory	Severity	Resolved by
GHSA-hmx5-qpq5-p643 prototype pollution in swiper	critical	swiper 14.2.0
GHSA-chx6-hx7r-mcp5 react-router unauthenticated DoS via route matching	high	react-router 7.18.3
GHSA-2j2x-hqr9-3h42 react-router open redirect via protocol-relative URL	moderate	react-router 7.18.3
GHSA-4w7w-66w2-5vf9 vite path traversal in optimized deps .map	high	vite 7.3.x
GHSA-p9ff-h696-f583 vite arbitrary file read via dev-server WebSocket	high	vite 7.3.x
GHSA-v6wh-96g9-6wx3 launch-editor NTLMv2 hash disclosure	moderate	vite 7.3.x
GHSA-fx2h-pf6j-xcff vite server.fs.deny bypass on Windows	high	vite 7.3.x
GHSA-mw96-cpmx-2vgc rollup arbitrary file write via path traversal	high	lockfile refresh
GHSA-3v7f-55p6-f55p / GHSA-c2c7-rcm5-vvqj picomatch glob injection + ReDoS	high	lockfile refresh
GHSA-25h7-pfq9-p65f / GHSA-rf6f-7fwh-wjgh flatted recursion DoS + prototype pollution	high	lockfile refresh
GHSA-48c2-rrv3-qjmp yaml stack overflow	moderate	lockfile refresh
GHSA-g7r4-m6w7-qqqr esbuild arbitrary file read on Windows dev server	low	lockfile refresh

Before: 14 vulnerabilities (1 critical, 10 high, 2 moderate, 1 low). After: 0.

Skipped

Package	Latest	Kept at	Reason
typescript	7.0.2	6.0.3	npm run lint fails outright: "typescript-eslint does not support TS 7.0" (typescript-eslint#10940). tsc --noEmit and the build actually pass on TS 7, so this is purely a lint-tooling gap — revisit once typescript-eslint ships TS 7 support.
vite	8.2.2	7.3.x	@vitejs/plugin-react@6 (the only plugin-react line that peers on vite 8) drags in optional peer @rolldown/plugin-babel@0.2.3, which needs @babel/core@^7.29.0 || ^8.0.0-rc.1; npm resolves that to the prerelease 8.0.0-rc.4 and aborts with ERESOLVE. Not fixable without --force/--legacy-peer-deps, so held back.
@vitejs/plugin-react	6.1.1	5.2.0	Same ERESOLVE conflict — coupled to vite 8.
@fullcalendar/core, @fullcalendar/react	7.0.2	6.1.21	The plugin packages this app uses (daygrid, timegrid, list, interaction) have no 7.x release; installing core/react 7 alongside them is an unresolvable peer conflict. Upgrade the whole FullCalendar set together once the plugins ship 7.x.
eslint-plugin-react-hooks	7.1.1	5.2.0	v7 enables the React Compiler rule set, producing 4 new lint errors in existing app code (react-hooks/purity on Date.now() in Calendar.tsx; react-hooks/set-state-in-effect in ThemeContext.tsx, AppSidebar.tsx, Calendar.tsx). Fixing them means refactoring component logic, which is out of scope for a dependency PR. Took the 5.2.0 minor instead.

Source impact

Actively imported in src/: react, react-dom, react-router, apexcharts + react-apexcharts (5 chart components), @fullcalendar/* (Calendar.tsx), react-dropzone (DropZone.tsx), react-helmet-async (PageMeta.tsx), tailwind-merge, swiper (CSS bundle only, in main.tsx), tailwindcss (via index.css).

Build/lint tooling only: vite, @vitejs/plugin-react, vite-plugin-svgr, typescript, eslint, @eslint/js, typescript-eslint, eslint-plugin-react-hooks, eslint-plugin-react-refresh, globals, postcss, @tailwindcss/postcss, @types/react, @types/react-dom.

Validation

Run after every batch, and green on the final tree (this repo has no test script):

• npm run lint — 0 errors, 2 warnings (both react-refresh/only-export-components, pre-existing on main)
• npx tsc --noEmit — clean
• npm run build — succeeds (tsc -b + vite); only pre-existing warnings (Use of eval from @react-jvectormap/core, >500 kB chunk notice)
• npm audit — 0 vulnerabilities

Video demo

Full UI walkthrough on the upgraded tree (npm run dev, vite 7.3.6): dashboard + all three ApexCharts 7 charts with a live hover tooltip and tab re-render, FullCalendar event creation, form inputs, react-dropzone 20 drag-and-drop, table/chart/alert/button/profile/sign-in pages, and Tailwind v4 dark mode. 0 console errors and 0 console warnings across the whole session.

Link to Devin session: https://app.devin.ai/sessions/29892f3af7c8431d9c725051b24f1123
Open in Devin Desktop: https://app.devin.ai/desktop/session/29892f3af7c8431d9c725051b24f1123?variant=devin
Requested by: @dr-phil

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring