📦 Frontend: Upgrade Vite to v8 and resolve esbuild security vulnerability

[lzw-git-all]

Summary

Running npm install in frontend/ reveals 2 moderate security vulnerabilities from esbuild, and a warning about missing module type declaration.

Current Versions

vite: 5.4.21
esbuild: 0.21.5 (from vite dependency)

Security Vulnerabilities

Package	Severity	Issue
esbuild <= 0.24.2	Moderate	Development server allows any website to send requests and read responses

Impact: This vulnerability only affects the development server (npm run dev). Production builds (npm run build) are safe.

Reference: GHSA-67mh-4wv8-2f99

Node.js Warning

Warning: Module type of file:///.../frontend/postcss.config.js is not specified

Fix: Add "type": "module" to frontend/package.json.

---

Suggested Upgrade to Vite 8.x

Vite 8.0.8 is the latest stable version with the following key changes:

Major Breaking Changes (Vite 5 → 8)

1. Rolldown replaces esbuild/Rollup - New bundler architecture
2. Configuration changes:
   • build.rollupOptions → build.rolldownOptions
   • worker.rollupOptions → worker.rolldownOptions
   • optimizeDeps.esbuildOptions → optimizeDeps.rolldownOptions
3. Oxc for JavaScript transforms - esbuild option deprecated, use oxc
4. Lightning CSS for CSS minification - build.cssMinify: 'esbuild' to revert
5. Updated browser targets - Chrome 107→111, Safari 16.0→16.4

Migration Notes

Current vite.config.ts uses manualChunks in rollupOptions:

rollupOptions: {
  output: {
    manualChunks: { ... }
  }
}

After upgrade, this should become rolldownOptions.

Recommended Actions

1. Upgrade vite: npm install vite@8 @vitejs/plugin-react@latest
2. Update vite.config.ts to use new rolldownOptions syntax
3. Add "type": "module" to frontend/package.json
4. Test development server and production build
5. Review Vite Migration Guide for full details

Environment

• Node.js: v24.14.1
• npm: 11.11.0
• OS: Linux

---

Thanks for this great project!