chore(deps): upgrade all dependencies (2026-09-14)

[devin-ai-integration]

Summary

Upgrades every outdated npm dependency (27 of 30), batched into separate commits (patch → minor → one commit per major) so any batch can be reverted independently. Validation (npm run lint, npm run build = tsc -b && vite build, npx tsc --noEmit) is green after every commit; there is no test script in this repo. npm audit goes from 16 advisories (1 critical, 12 high) to 0.

Two things to know that the diff doesn't make obvious:

• Vite 8 was tried and reverted to 7.x (vite@~7.3.6, @vitejs/plugin-react@^5.2.0): Vite 8's rolldown bundler breaks the unmaintained webpack-eval CJS bundle shipped by @react-jvectormap/core; the app rendered a blank page with css_loader_dist_runtime_api_js__WEBPACK_IMPORTED_MODULE_1___default(...) is not a function in both vite dev and the production build. Vite 7 works and still clears all Vite GHSAs.
• eslint-plugin-react-hooks 7 ships React Compiler rules (set-state-in-effect, purity) that flag 4 places in existing code (ThemeContext.tsx, AppSidebar.tsx, Calendar.tsx). These are set to warn in eslint.config.js rather than refactoring app code in a deps PR; the pre-existing 2 react-refresh warnings remain, total 0 errors / 6 warnings.

Upgrade table

Batch 1 — patch (chore(deps): upgrade patch dependencies)

Package	From	To
@fullcalendar/daygrid, interaction, list, timegrid	6.1.15	6.1.21
postcss	8.5.6	8.5.28

Batch 2 — minor (chore(deps): upgrade minor dependencies)

Package	From	To
react, react-dom	19.0.0	19.3.0
@types/react, @types/react-dom	19.0.12 / 19.0.4	19.3.0
tailwindcss, @tailwindcss/postcss	4.0.8	4.3.3
tailwind-merge	3.0.1	3.7.0
typescript-eslint	8.24.0	8.70.0
eslint-plugin-react-refresh	0.4.19	0.5.6

Batch 3 — major (one commit each)

Package	From	To	Notes
swiper	11.2.3	14.2.0	only swiper-bundle.css is imported
react-router	7.9.5	8.3.1
apexcharts + react-apexcharts	4.4.0 / 1.7.0	7.3.0 / 2.1.1	coupled, upgraded together
react-dropzone	14.3.5	20.1.2
react-helmet-async	2.0.5	3.0.0	v3 declares React 19 peer, so the overrides entry for it was removed
vite + @vitejs/plugin-react + vite-plugin-svgr	6.4.1 / 4.3.4 / 4.3.0	7.3.6 / 5.2.0 / 5.2.0	see Vite 8 note above
eslint + @eslint/js + globals + eslint-plugin-react-hooks	9.39.1 / 9.39.1 / 15.15.0 / 5.1.0	10.10.0 / 10.0.1 / 17.12.0 / 7.1.1	react-hooks 7 required by eslint 10 peer range
typescript	5.7.3	6.0.3	tilde pin kept (~6.0.3)

Plus npm audit fix (no --force) for transitive js-yaml / @humanfs/node.

Security fixes

All 16 baseline advisories resolved, including: swiper GHSA-hmx5-qpq5-p643 (critical); react-router 13 GHSAs (e.g. GHSA-2w69-qvjg-hvjx, GHSA-9jcx-v3wj-wh4m, GHSA-f22v-gfqf-p8f3); vite GHSA-4w7w-66w2-5vf9, GHSA-p9ff-h696-f583, GHSA-v6wh-96g9-6wx3, GHSA-fx2h-pf6j-xcff; postcss GHSA-qx2v-qp2m-jg93 et al.; rollup GHSA-mw96-cpmx-2vgc; transitive brace-expansion, minimatch, picomatch, nanoid, browserslist, flatted, js-yaml, ajv, yaml, @babel/core, @humanfs/node. npm audit → found 0 vulnerabilities.

Skipped packages

Package	Current	Latest	Reason
@fullcalendar/core, @fullcalendar/react (and plugins)	6.1.x	7.1.0	v7 is an architectural rewrite: plugin packages (daygrid/timegrid/interaction) are folded into the connector, new temporal-polyfill peer, and new DOM/CSS — src/index.css has 47 custom .fc-* rules that would need rewriting. Not a straightforward migration.
vite / @vitejs/plugin-react	7.3.6 / 5.2.0	8.3.0 / 6.1.1	Runtime blank page due to @react-jvectormap/core incompatibility (see Summary).
typescript	6.0.3	7.0.2	typescript-eslint 8.70 hard-errors on TS 7 ("does not support TS 7.0"); 6.0.3 is the newest version in its supported range <6.1.

Source impact

• Imported in src/: react/react-dom, react-router (16 files), apexcharts + react-apexcharts (charts), react-dropzone (DropZone.tsx), react-helmet-async (PageMeta.tsx), tailwind-merge, swiper (CSS only), @fullcalendar/* (Calendar.tsx, patch-only).
• Dev/build tooling only: vite + plugins, tailwindcss + postcss, typescript, eslint + plugins, @types/*.
• Code changes outside package*.json: only eslint.config.js (two rule severities).

Validation

• npm run lint: pass (0 errors, 6 warnings)
• npm run build (tsc -b && vite build): pass
• npx tsc --noEmit -p tsconfig.app.json: pass
• npm test: no test script in repo
• npm audit: 0 vulnerabilities
• Manual walkthrough on npm run dev: dashboard, all sidebar pages (Calendar, Profile, Form Elements, Tables, Line/Bar charts, UI elements, Sign In), dark mode, sidebar collapse, Ctrl+K search, calendar event create/reopen, dropzone upload — 0 console errors.

Video demo

Dashboard	Dark mode	Calendar event saved

Link to Devin session: https://app.devin.ai/sessions/615ed26bfcdf41478fec10ef0f5bdb21
Open in Devin Desktop: https://app.devin.ai/desktop/session/615ed26bfcdf41478fec10ef0f5bdb21?variant=devin
Requested by: @dr-phil

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring