Clears the last outstanding advisory (GHSA-395f-4hp3-45gv, quadratic
complexity DoS in shell-quote's parse()). npm audit now reports 0
vulnerabilities, down from 3 before this branch.
concurrently pins "shell-quote": "1.8.4" exactly, and the maintainers
patched only the 9.x line (9.2.4 ships shell-quote 1.9.0) while 10.x still
carries 1.8.4. npm's only offered remedy was therefore a downgrade to
concurrently@9.2.4. The override keeps concurrently at 10.0.3 and resolves
shell-quote to 1.10.0 instead.
Overriding a deliberate exact pin warrants checking concurrently still
works, so this was verified functionally in node:24-alpine rather than
assumed: quoted and escaped arguments parse correctly (the shell-quote
code path), named prefixes render, and --kill-others-on-fail still
propagates a non-zero exit. npm install, npm ci and npm run build all
succeed, build hashes are unchanged, and the PHP suite passes 123 tests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump Vite 7 to 8 and laravel-vite-plugin 2 to 3. These are coupled:
laravel-vite-plugin@3.1.3 peer-requires vite ^8.0.0, so neither moves alone.
Also concurrently 9 to 10, tailwindcss and @tailwindcss/vite to 4.3.3,
daisyui to 5.7.0, alpinejs to 3.15.12 and autoprefixer to 10.5.4.
Drop axios. It had zero imports anywhere in resources/ or vite.config.js,
and Laravel 13 removed it from the skeleton along with resources/js/bootstrap.js.
Drop the @rollup/rollup-linux-x64-gnu optional dependency. Vite 8 builds with
rolldown instead of rollup, so the pin no longer refers to anything in the
build, and it was stuck at an exact 4.9.5 against a rollup that had since
reached 4.62.x. The oxide and lightningcss optional pins are kept, as those
native binaries are still used by tailwind and vite.
vite.config.js needed no changes: it sets no rollupOptions, esbuild or
manualChunks, so nothing hit the vite 8 config renames. Node engines
(^20.19 || >=22.12) are satisfied by the node:24-alpine build stage, the
dev container's Node 24.17 and CI's Node 24.
Verified in a node:24-alpine container matching the Dockerfile assets stage:
npm install, npm run build (vite 8.1.5, 3 modules, deterministic hashes) and
npm ci all succeed. The rendered /upload page references the new build hashes,
and the PHP suite still passes 123 tests.
npm audit fix patched a pre-existing picomatch advisory reached via
laravel-vite-plugin's vite-plugin-full-reload, with no downgrades. A
shell-quote advisory via concurrently remains and is also pre-existing;
concurrently is a local dev orchestration tool only and is not shipped
to browsers.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
