chore(deps): upgrade all dependencies (2026-04-16)

[devin-ai-integration]

Summary

Upgrades 29 outdated npm dependencies across patch, minor, and major versions. No source code changes — only package.json and package-lock.json are modified. Lint and build pass after all upgrades. Frontend manually verified via dev server walkthrough.

Patch upgrades (9 packages)

Package	Old	New
@fullcalendar/core, daygrid, interaction, list, react, timegrid	6.1.15	6.1.20
@eslint/js	9.19.0	9.39.4
eslint	9.19.0	9.39.4
postcss	8.5.2	8.5.10

Minor upgrades (13 packages)

Package	Old	New
react / react-dom	19.0.0	19.2.5
react-router	7.1.5	7.14.1
tailwindcss / @tailwindcss/postcss	4.0.8	4.2.2
tailwind-merge	3.0.1	3.5.0
@types/react	19.0.12	19.2.14
@types/react-dom	19.0.4	19.2.3
eslint-plugin-react-refresh	0.4.18	0.5.2
typescript-eslint	8.22.0	8.58.2
vite	6.1.0	6.4.2
@vitejs/plugin-react	4.3.4	4.7.0
vite-plugin-svgr	4.3.0	4.5.0

Major upgrades (7 packages)

Package	Old	New
apexcharts	4.1.0	5.10.6
react-apexcharts	1.7.0	2.1.0
react-dropzone	14.3.5	15.0.0
react-helmet-async	2.0.5	3.0.0
swiper	11.2.3	12.1.3
typescript	5.7.2	6.0.2
globals	15.14.0	17.5.0

Skipped packages

Package	Current	Latest	Reason
eslint-plugin-react-hooks	5.1.0	7.0.1	v7 introduces new lint rules (set-state-in-effect, purity) that flag existing code as errors; upgrading would require source changes
vite	6.4.2	8.0.8	Vite 8 switches to Rolldown internally, which breaks @react-jvectormap/core at runtime (webpack-bundled CSS loader TypeError causes blank page). Kept at latest v6 minor instead
@vitejs/plugin-react	4.7.0	6.0.1	Requires vite 8 (peer dependency)
vite-plugin-svgr	4.5.0	5.2.0	Requires vite 8; v4 build uses deprecated transformWithEsbuild API removed in vite 8

Security fixes

Resolves vulnerabilities in: swiper (critical — prototype pollution), react-router (high — XSS/CSRF), and transitive deps (picomatch, minimatch, yaml). Note: vite high-severity vulnerabilities (file read/path traversal) may require vite 8 to fully resolve — the v6.4.2 minor may not include all fixes.

Validation

• npm run lint — passes (2 pre-existing warnings, 0 errors)
• npm run build (tsc -b && vite build) — passes
• npm run dev — frontend verified manually (dashboard, calendar, charts, forms all render; no JS console errors)

Frontend verification recording

View original video (rec-6fe2717a6a5f40779b4d94265d23f0a2-edited.mp4)

Review & Testing Checklist for Human

• Charts rendering: apexcharts 4→5 and react-apexcharts 1→2 are major bumps. Manually verify all chart components (line charts, bar charts, radial bar on the dashboard) render correctly with real data — automated testing does not cover this.
• Swiper 11→12: Verify any carousel/slider components still function (navigation, pagination, touch interactions).
• TypeScript 5→6: While tsc -b passes, watch for any subtle type behavior changes in IDE or CI that may surface later.
• overrides section still present for react-helmet-async and @react-jvectormap: v3 of react-helmet-async may natively support React 19, making the override unnecessary — verify and consider removing.
• Vite security: Confirm whether the vite v6.4.2 minor resolves the high-severity file read/path traversal advisories, or whether those fixes are only in v8+.

Recommended test plan: Run npm run dev, navigate through all dashboard pages (home, calendar, charts, forms, tables, user profile), interact with charts/sliders/dropdowns/date pickers, and check the browser console for runtime errors.

Notes

• eslint-plugin-react-hooks was intentionally kept at v5 to avoid introducing lint errors in existing code that would require source-level refactoring.
• Vite 8 was attempted but reverted after discovering it breaks @react-jvectormap/core at runtime (blank page). The vite ecosystem (vite, @vitejs/plugin-react, vite-plugin-svgr) was upgraded to latest minor versions within their current major instead.
• The TypeScript pinning convention (~ tilde) was preserved per the repo's existing convention; all other packages use ^ caret.
• No automated test suite exists (npm test is not configured); e2e tests are Python-based in a separate directory. Frontend was verified manually via screen recording.

Link to Devin session: https://app.devin.ai/sessions/3e0ba8a54f5d493888b2eac389f8ab7d
Requested by: @dr-phil

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.