Dependency drift: 29 outdated packages, toolchain a full major behind

[kitikonti]

Problem

29 dependencies are outdated, including a full major version behind across most of the build and test toolchain. Nothing is broken today — ci:local is green and all 5,239 unit tests pass — but the gap grows more expensive to close the longer it is left.

Current drift

npm outdated (as of v1.7.9):

Major version behind — toolchain

Package	Current	Latest	Notes
vite	5.4.21	8.2.2	3 majors
vitest / @vitest/ui / @vitest/coverage-v8	1.6.1	4.1.11	3 majors; also relevant to the coverage config in #84
typescript	5.9.3	7.0.2
eslint	8.57.1	10.8.1	8→9 is the flat-config migration
@typescript-eslint/*	6.21.0	8.67.0	must move with eslint
eslint-plugin-react-hooks	4.6.2	7.1.1	must move with eslint
tailwindcss	3.4.19	4.3.3	v4 is a config/engine rewrite
@vitejs/plugin-react	4.7.0	6.1.0	must move with vite
vite-plugin-svgr	4.5.0	5.2.0	must move with vite
jsdom	24.1.3	30.0.1
commit-and-tag-version	12.6.1	13.1.2	release tooling

Major version behind — runtime / testing

Package	Current	Latest	Notes
react / react-dom	18.3.1	19.2.8	biggest blast radius
@types/react / @types/react-dom	18.3.x	19.2.x	move with react
@testing-library/react	14.3.1	16.3.2	v16 requires React 19
@testing-library/jest-dom	6.9.1	7.0.1

Minor/patch only — safe, low effort

@playwright/test 1.57.0→1.62.1, @testing-library/user-event 14.6.1→14.6.5, autoprefixer 10.4.22→10.5.4, date-fns 4.1.0→4.4.0, date-holidays 3.26.6→3.35.0, dompurify 3.3.3→3.4.14, immer 11.0.1→11.1.18, postcss 8.5.6→8.5.26, prettier 3.7.4→3.9.6

Proposed approach

Do this in separate PRs, smallest blast radius first. Do not batch — a single mega-bump makes failures impossible to attribute.

1. Patch/minor sweep — everything in the third table. Low risk, one PR. prettier may reformat files (expect a large diff; run npm run format as its own commit). dompurify + date-holidays also help close npm audit: 2 vulnerabilities from transitive js-yaml@4.1.1 #85.
2. Playwright — bump @playwright/test, then regenerate VRT baselines in Docker (npm run test:vrt:update) since a renderer change can shift screenshots. See CLAUDE.md → Visual Regression Tests.
3. Vitest 1 → 4 — coordinate with Coverage thresholds are silently not enforced, and coverage scope includes stale worktrees #84; the coverage config changes in that issue are already written in the v1+ thresholds shape, so land that first.
4. ESLint 8 → 10 — requires flat config (eslint.config.js replacing .eslintrc), moving @typescript-eslint/* to v8 and eslint-plugin-react-hooks to v7 in the same PR. Self-contained.
5. Vite 5 → 8 — with @vitejs/plugin-react and vite-plugin-svgr. Verify the export pipeline chunks still split correctly (pdfExport, date-vendor, html2canvas are large manual chunks).
6. TypeScript 5 → 7 — expect new strictness errors; project is already strict.
7. Tailwind 3 → 4 — config rewrite. Careful: the color system (Issue audit: analyze color system — consolidate scales, eliminate hardcoded values #56) depends on tailwind.config.js importing from src/styles/colors.js and on theme("colors.slate.X") resolving in index.css. Tailwind v4 moves theme config into CSS. This needs its own plan; npm run lint:colors must still pass.
8. React 18 → 19 — last, with @testing-library/react v16. Largest surface: 278 source files, React.memo usage, D3/SVG interop, @dnd-kit compatibility.

Acceptance criteria

Per PR:

• npm run ci:local passes
• npm run test:e2e passes (Docker)
• npm run test:vrt passes, or baselines regenerated in Docker with the diff reviewed
• Export pipeline manually verified (PNG/PDF/SVG) for any PR touching vite, react, or tailwind

Notes

Steps 7 and 8 are large enough to be their own issues once the earlier steps land. Steps 1-2 are worth doing now regardless.

Related: #84, #85