chore(deps): group low-risk frontend bumps (ai, eslint, vite, types)

[westonplatter]

Summary

Batches the eight open low-tier bun dependabot PRs into one reviewable change, and picks up a high-severity transitive advisory along the way. bun add writes exact pins and discards the caret, so the ranges were restored afterwards — package.json moves only the eight version floors, nothing changed dep/devDep sections.

Package	From	To	Kind	Supersedes
ai	7.0.62	7.0.68	runtime patch	#208
@ai-sdk/react	4.0.65	4.0.71	runtime patch	#214
globals	17.8.0	17.10.0	dev minor	#211
eslint	10.8.0	10.8.1	dev patch	#212
@vitejs/plugin-react	6.0.4	6.0.5	dev patch	#215
eslint-plugin-react-refresh	0.5.3	0.5.4	dev patch	#216
@types/node	26.1.2	26.2.0	type stubs minor	#217
vite	8.2.0	8.2.1	dev patch	#218

Features

N/A

Refactoring

N/A

Fixes

• Drops GHSA-2v37-7h3g-55p8 (nanoid, high — custom generators loop indefinitely when size is zero). No bot PR could reach it: nanoid has no direct entry and sits under vite › postcss. vite 8.2.1 pulls postcss 8.5.26, which requires nanoid >=3.3.18, so the advisory resolves without an overrides entry. Audit goes 5 → 4.

Verification

Measured with compare_baseline.py --adapter bun, which diffs a detached worktree at origin/main against this tree:

metric	origin/main	this branch	verdict
build (tsc -b + vite build)	0 errors	0 errors	same
lint (eslint .)	0 errors	0 errors	same
audit (bun audit)	5 vulnerabilities	4	better (−1)

Three of the eight (eslint, eslint-plugin-react-refresh, vite) are in the adapter's baseline_tools — they produce the counts above, so an unchanged number is not by itself evidence. The findings were diffed directly:

• bun run lint output is byte-identical before and after.
• bun run build output differs only in the vite v8.2.0 → v8.2.1 banner; the emitted asset list and hashes are unchanged.

Also run locally, matching the CI frontend job: bun run typecheck (clean) and bun test (71 pass, 0 fail).

Lock blast radius: 13 entries moved for 8 requested packages. The 5 extras are each parented by one of the eight, not a graph re-resolve — @ai-sdk/gateway 4.0.54 via ai, @ai-sdk/mcp 2.0.33 via @ai-sdk/react, jiti 2.7.0 via eslint/vite, postcss 8.5.26 and nanoid 3.3.18 via vite.

Cooldown: all thirteen versions — the eight direct bumps and the five transitive extras that no bot PR ever proposed — are past the repo's 14-day window (oldest 15d, ai and @ai-sdk/*; bunfig.toml minimumReleaseAge enforces this mechanically on the direct installs).

Documentation

None needed — no behavior change.

Additional notes

• Superseded PRs chore(deps): bump ai from 7.0.62 to 7.0.68 in /frontend #208, chore(deps-dev): bump globals from 17.8.0 to 17.10.0 in /frontend #211, chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 in /frontend #212, chore(deps): bump @ai-sdk/react from 4.0.65 to 4.0.71 in /frontend #214, chore(deps-dev): bump @vitejs/plugin-react from 6.0.5 to 6.1.0 in /frontend #215, chore(deps-dev): bump eslint-plugin-react-refresh from 0.5.3 to 0.5.4 in /frontend #216, chore(deps-dev): bump @types/node from 26.1.2 to 26.2.0 in /frontend #217, chore(deps-dev): bump vite from 8.2.1 to 8.2.2 in /frontend #218 stay open until this merges; each has been commented.
• chore(deps-dev): bump typescript-eslint from 8.66.0 to 8.67.0 in /frontend #210 (typescript-eslint 8.66.0 → 8.67.0) is medium tier and ships separately, so a lint regression from the tool that produces the lint count stays bisectable.
• The remaining 4 audit findings are all transitive with no direct entry (@babel/core, @humanfs/node, browserslist ×2) and need overrides — out of scope here, since the skill ships pins as their own PR.
• Produced with the repo's grouped-dependency-upgrades skill.

🤖 Generated with Claude Code

https://claude.ai/code/session_011wzZeis7evtxWQtZaQWis6

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 9be90a75-6f5e-474d-bc52-ba99a0b06f01

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}