chore: update dependencies and sitemap lastmod dates

[devaraj3]

What changed

• vite: 5.4.21 → 6.4.3
• vite-react-ssg: 0.7.0 → 0.9.2 (required pairing — supports vite 6.x; also incidentally removes a separate high-severity html-minifier dependency entirely)
• Added a package.json overrides block forcing three transitive dependencies that wouldn't bump on their own:
  • postcss → 8.5.23
  • js-yaml → 4.3.0
  • brace-expansion → 1.1.16 (root) and 5.0.8 (nested, under @typescript-eslint/typescript-estree)
• esbuild resolved naturally to 0.25.12 via vite 6.4.3's own dependency, rather than force-overriding to a version outside vite's declared range

Why

• Hostinger's dependency scanner flagged 19 known vulnerabilities (0 critical, 7 high, 11 moderate, 1 low)
• This patches every high-severity item and 9 of 11 moderate items, without touching anything that would break the Tier 2 prerendering setup

Deliberately NOT changed

• react-router / react-router-dom (2 moderate CVEs, both left untouched): no version of vite-react-ssg — including the latest 0.9.2 just adopted here — supports react-router 7.x as a peer dependency. Upgrading this would break SSR/prerendering entirely. Revisit once vite-react-ssg adds react-router 7 support.
• @babel/core (1 low CVE): wasn't part of the original patch list, brought in by @vitejs/plugin-react, left untouched — flagged for future visibility only.

Validation

• npm run build — succeeded, all 3 routes prerendered correctly
• npm run lint — 0 errors (26 pre-existing unrelated warnings)
• npm run typecheck — clean
• npm run preview — manually confirmed: / shows real SSR content with JSON-LD intact, /viewer loads and a test file uploads/orbits correctly with no console errors, /guides/split-step-assembly still fully server-rendered
• After merge: re-check Hostinger's vulnerability dashboard directly — don't rely on the local npm audit count (10→8) as the final word, since it doesn't cleanly match Hostinger's own count/methodology

Notes

• The remaining 2 moderate (react-router) + 1 low (@babel/core) items are expected to still appear after this merges — that's correct, not a failure of this patch

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cad-viewer	Ready	Preview, Comment	Jul 27, 2026 4:47am