[Mudaafi]

Combines the six open Dependabot PRs onto main and raises CI's Node version so the upgraded tooling can actually run.

Supersedes #9, #12, #13, #14, #17, #18. Dependabot's original commits are preserved in the history; the package-lock.json conflicts between them were resolved by re-resolving the tree from the merged package.json.

Dependency updates

Package	From	To
eslint	9.39.2	10.12.0
@eslint/js	9.39.2	10.0.1
vite	7.3.1	8.3.4
@vitejs/plugin-react	5.1.1	5.2.0
typescript-eslint	8.54.0	8.71.2
eslint-plugin-react-hooks	7.0.1	7.1.1
postcss	8.5.6	8.5.30
nanoid	3.3.11	3.3.20
source-map-js	1.2.1	1.2.2
brace-expansion	2.0.2	5.0.12

Three things reviewers should know

1. eslint-plugin-react-hooks 7.0.1 → 7.1.1 was mandatory, not opportunistic. ESLint 10 falls outside the peer range 7.0.1 declares, so npm ci fails outright with ERESOLVE. 7.1.1 is the first release accepting ^10.0.0. This is why #12 could not have merged green on its own.

2. CI's Node was below its own dependencies' floor. All workflows pinned 18.13.0, but ESLint 10 and Vite 8 declare ^20.19.0 || ^22.13.0 || >=24. Workflows now pin 22.20.0. The deprecated actions/checkout@v2,v3 and actions/setup-node@v2 are bumped to v4 in the same pass.

Worth noting: CI reported no checks at all on #9 and #12, so none of this surfaced upstream.

3. #14 and #9 are satisfied incidentally and can be closed rather than merged. ESLint 10 no longer depends on @eslint/eslintrc (which brought in js-yaml), and Vite 8 bundles rolldown instead of esbuild — both target packages leave the tree entirely.

Deliberate exclusion: constructorio-ui-plp held at 1.8.0

No Dependabot PR asked to move it, and letting it float to 1.20.0 has two side effects worth their own PR:

• It pulls in @constructor-io/constructorio-ui-components → @tailwindcss/vite → lightningcss (MPL-2.0) as a production dependency, which fails npm run check-license — MPL-2.0 is not on the allowlist.
• It bumps @constructor-io/constructorio-client-javascript 2.73.1 → 2.94.0, i.e. 21 minor versions of the live API client — a runtime behaviour change that shouldn't ride along in a lockfile merge.

With it pinned, the production dependency tree is unchanged from main apart from react/react-dom 19.2.4 → 19.3.0.

Verification (local, Node 22.20.0)

Check	Result
npm ci	✅ clean
npm run lint	✅ no errors
tsc --noEmit	✅ clean
npm run build:plp	✅ 364.63 kB (gzip 106.82 kB)
cspell	✅ 0 issues
npm audit	✅ 0 vulnerabilities
Bundle smoke test	✅ IIFE evaluates, exposes CioPlp global
npm run check-license	⚠️ see below

Pre-existing: check-license fails on main too

license-checker reads the root package as UNLICENSED (private: true, no resolvable license field), so the job exits non-zero. I confirmed this fails identically on a clean main worktree — it is not caused by these upgrades, but it does mean the job is currently red on every PR. Every dependency license passes the allowlist. Happy to fix it here or separately.

New Vite 8 build warnings (non-fatal)

(!) Your Vite config uses features that are unsupported by `configLoader: 'native'`:
  - `__dirname` (vite.config.ts:18:20). Use `import.meta.dirname` instead

WARN  inlineDynamicImports option is ignored because codeSplitting: false is set.

Both build fine today but will matter in a future Vite major. Left alone to keep this PR to dependencies.

🤖 Generated with Claude Code