chore(deps): bump 15 of 19 npm-vueapp deps, hold typescript 7

[dependabot]

Review outcome

Dependabot proposed 19 updates. Of those, 15 land as proposed, 2 are held back, and 2 are dropped because the packages themselves were dead weight in this manifest. Plus one dependency correctness fix. Rebased onto latest main.

Held back

Package	Proposed	Landed	Reason
typescript	7.0.2	^6.0.3 (unchanged)	Breaks npm ci outright
@types/node	26.1.1	^24.13.3	Types must track the Node 24 runtime

typescript 7.0.2

TypeScript 7 is the native Go compiler, and the npm package no longer ships the compiler JS API. Its entire lib/ is now:

package/bin/tsc
package/lib/getExePath.js   <- locates the native binary
package/lib/tsc.js          <- thin launcher
package/lib/version.cjs     <- the "." export, exports only { version, versionMajorMinor }

The package drops from 23 MB to 2.38 MB plus 20 platform-specific native binaries, and tsserver is gone from bin. Any programmatic consumer of the API breaks: typescript-eslint, ts-api-utils, and @volar/typescript behind vue-tsc --build.

So @typescript-eslint/* correctly caps its peer at typescript@">=4.8.4 <6.1.0", and npm ci fails before a single test runs:

npm error code ERESOLVE
npm error Could not resolve dependency:
npm error peer typescript@">=4.8.4 <6.1.0" from @typescript-eslint/eslint-plugin@8.65.0
npm error Found: typescript@7.0.2

That is the actual CI failure on this PR's earlier run (Frontend Tests failed in 8s, Fallow regression in 16s).

No published typescript-eslint accepts TS 7, including 8.66.0 and every 8.66.1-alpha.* canary. Forcing it with --legacy-peer-deps or an override would swap a fast install failure for a silently broken linter and type-checker. TypeScript 7 needs its own PR once upstream ships support.

@types/node 26.1.1

@types/node majors track Node majors, so 26.x describes APIs the runtime does not have. Everything here is pinned to Node 24: engines.node and volta at 24.16.0, node-version: 24 across all five CI jobs, and @tsconfig/node24.

Per the Node release schedule, v24 is Active LTS until 2026-10-20 and supported to 2028-04-30, while v26 is Current and does not reach LTS until 2026-10-28.

The concrete risk is not tidiness: @types/node@26 pulls undici-types@~8.3.0, while Node 24 ships undici 7. That types fetch, Headers, Response, and FormData per undici 8, so type-check passes and the runtime throws. Bumped within the 24 line instead (24.13.2 to 24.13.3).

.github/dependabot.yml now ignores @types/node majors for /VueApp so this does not recur monthly. Remove that when the runtime moves.

Also in this branch

• Declares @vue/devtools-api ^8.2.1. pinia 4 moved it from dependencies to a required, non-optional peer. npm auto-installs it so nothing breaks today, but it was an undeclared implicit dependency of the app bundle.
• Removes oxfmt and oxlint-tsgolint from VueApp. They were never used from here. scripts/lint-any.js spawns npx oxfmt with cwd: projectRoot, scripts/lint-staged-ts.js runs oxlint from projectRoot (passing --type-aware --tsconfig=VueApp/tsconfig.json), .oxlintrc.json exists only at the repo root, no VueApp script invokes them, and no CI job runs them. Verified after removal that npx oxfmt and npx oxlint still resolve from root. This also removes the version skew against chore(deps-dev): bump the npm-root group with 8 updates #280, which moves root to oxfmt 0.60.0 and oxlint-tsgolint 7.0.2001.

Net effect on the lockfile is 580 insertions against 1009 deletions, since dropping the dead deps removes 19 @oxfmt/* and 6 @oxlint-tsgolint/* platform binaries, and holding TypeScript at 6 keeps 20 @typescript/typescript-* natives out.

Supply chain review

All 19 direct updates plus 113 changed or added lockfile entries were checked.

• Publication age: all pass. Youngest is eslint@10.8.0 at 11 days. .npmrc min-release-age=7 and the Dependabot cooldown already enforce this.
• Advisories: npm audit reports 3 pre-existing issues (brace-expansion, postcss, undici). I audited main's lockfile separately and it reports the identical 3, so this PR neither introduces nor fixes any. OSV batch query across all 113 new package versions returned zero hits.
• Install hooks: zero new ones. The only package in the tree with hasInstallScript is fsevents@2.3.3, darwin-only and pre-existing.
• Provenance: pinia, vue-router, vue, vite, oxfmt, happy-dom, vue-tsc, and nostics all carry SLSA v1 attestations. typescript and eslint have none, which is normal for both.
• pinia's "new releaser" notice is the project adopting npm trusted publishing. The SLSA attestation confirms the build came from vuejs/pinia.
• nostics@1.2.0, a new transitive from pinia 4 and vue-router 5.2, is vercel-labs/nostics, MIT, maintained by danielroe, posva, and antfu. posva authors both dependents, so it is first-party. Not a typosquat.
• pinia 3 to 4 is ESM-only with a devtools-api peer change. App usage is createPinia, defineStore, and storeToRefs, all stable across the major.

Verification

Check	Result
npm install	Clean, no ERESOLVE
npm run test:frontend	87 files, 1116 tests, all pass on vitest 4.1.10
vue-tsc --build --force	Exit 0, forced full rebuild so the incremental cache could not mask errors
npm run verify:build	Vue build, Vue TS compilation, and .NET compilation all pass
npm run lint	oxfmt, oxlint, and type-check all run and pass

---

Original Dependabot report

The version table below is Dependabot's original proposal. See "Review outcome" above for what actually landed: typescript stays at 6.x and @types/node stays on the 24.x line.

Bumps the npm-vueapp group in /VueApp with 19 updates:

Package	From	To
pinia	3.0.4	4.0.2
vue	3.5.38	3.5.40
vue-chartjs	5.3.3	5.3.4
vue-router	5.1.0	5.2.0
@types/node	24.13.2	26.1.1
@typescript-eslint/eslint-plugin	8.62.0	8.65.0
@typescript-eslint/parser	8.62.0	8.65.0
@vitejs/plugin-vue	6.0.7	6.0.8
@vitest/coverage-v8	4.1.9	4.1.10
eslint	10.5.0	10.8.0
eslint-plugin-harlanzw	0.17.0	0.17.1
eslint-plugin-vue	10.9.2	10.10.0
happy-dom	20.10.6	20.11.1
oxfmt	0.56.0	0.60.0
oxlint-tsgolint	0.23.0	0.25.0
typescript	6.0.3	7.0.2
vite	8.1.4	8.1.5
vitest	4.1.9	4.1.10
vue-tsc	3.3.5	3.3.8

Dependabot's per-package release notes were trimmed here. That section had already hit GitHub's body length limit and self-truncated, and prepending this review would have overflowed it. Release notes for every package above are reachable from its link.

[codecov-commenter]

Bundle Report

Changes will increase total bundle size by 415 bytes (0.02%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
viper-frontend-esm	2.29MB	415 bytes (0.02%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: viper-frontend-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
assets/GenericError-*.js	-37 bytes	531.08kB	-0.01%
assets/vendor-*.js	421 bytes	272.4kB	0.15%
assets/TermManagement-*.js	-3 bytes	52.37kB	-0.01%
assets/SortableList-*.js	-3 bytes	45.53kB	-0.01%
assets/_plugin-*.js	32 bytes	14.23kB	0.23%
assets/use-*.js	-5 bytes	6.01kB	-0.08%
assets/EffortReportPage-*.js	11 bytes	1.79kB	0.62%
assets/ReportDeptTabs-*.js	10 bytes	1.12kB	0.9%
assets/InstructorPageShell-*.js	11 bytes	998 bytes	1.11%
assets/EmergencyContactPageShell-*.js	11 bytes	896 bytes	1.24%
assets/useApi-*.js	-33 bytes	819 bytes	-3.87%

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.09%. Comparing base (2242c14) to head (51d5448).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #281   +/-   ##
=======================================
  Coverage   50.09%   50.09%           
=======================================
  Files         998      998           
  Lines       58370    58370           
  Branches     5858     5858           
=======================================
  Hits        29239    29239           
  Misses      28228    28228           
  Partials      903      903           

Flag	Coverage Δ
backend	49.25% <ø> (ø)
frontend	58.45% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

Updates the VueApp’s npm dependencies (mostly Dependabot-proposed), while intentionally holding back TypeScript 7 and @types/node major bumps to preserve install correctness against the Node 24 runtime. Also aligns the VueApp manifest with upstream peer dependency requirements introduced by newer Pinia/Vue Router.

Changes:

• Bump Vue/Vite/Vitest/ESLint ecosystem packages in VueApp and refresh the lockfile accordingly.
• Add explicit @vue/devtools-api dependency required as a non-optional peer by Pinia 4.
• Configure Dependabot to ignore @types/node semver-major updates for /VueApp.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
VueApp/package.json	Updates direct deps/devDeps for the VueApp (incl. adding @vue/devtools-api, bumping core toolchain packages).
VueApp/package-lock.json	Regenerates lockfile to reflect updated dependency graph and removed unused packages.
.github/dependabot.yml	Adds an ignore rule preventing @types/node major bumps for the VueApp group.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

VueApp/package.json:65

• typescript is declared as ^6.0.3, but the updated @typescript-eslint/* toolchain declares a peer constraint of typescript >=4.8.4 <6.1.0 (see VueApp/package-lock.json). Keeping a caret range here allows npm/Dependabot to pick a future 6.1.x (or higher) release that would immediately break installs with an ERESOLVE peer conflict. Consider tightening the range to stay within the peer cap until typescript-eslint expands support.

        "typescript": "^6.0.3",