chore(frontend): update all frontend dependencies to latest

[karutoil]

Summary

Bring all catalyst-frontend dependencies (runtime + dev) up to their latest compatible versions, then verify the app still builds, lints, and passes tests.

This is a full refresh beyond Dependabot's weekly grouped minor/patch PRs — include major bumps where feasible, with intentional decisions documented for anything we intentionally pin or defer.

Scope

Item	Path
Package	catalyst-frontend/package.json
Lockfile	root pnpm-lock.yaml (pnpm workspace)
Workspace root tools that affect FE	root package.json (e.g. TypeScript) if needed for alignment

Key stacks to refresh

• React / React DOM / React Router
• Vite, Vitest, Playwright, TypeScript, ESLint
• TanStack Query / Virtual
• Radix UI primitives
• Tailwind CSS / PostCSS
• better-auth (+ passkey)
• Zod, React Hook Form, Framer Motion, Recharts, Monaco, Zustand

Acceptance criteria

• Audit current vs latest for every dependency in catalyst-frontend/package.json (pnpm outdated --filter catalyst-frontend or equivalent).
• Update all feasible packages to latest; document any intentionally skipped majors (reason + follow-up issue if needed).
• pnpm install succeeds; lockfile updated at repo root.
• pnpm --filter catalyst-frontend run lint passes.
• pnpm --filter catalyst-frontend run build passes.
• pnpm --filter catalyst-frontend run test passes.
• Spot-check critical UI flows (auth, server list, console/files, settings) if major framework bumps land.
• No new security advisories introduced; prefer fixes for any known CVEs.
• PR notes call out breaking changes and any required code migrations (e.g. Zod / React Router / Vite majors).

Suggested approach

1. Run pnpm outdated --filter catalyst-frontend and capture the baseline.
2. Update patch/minor first; then tackle majors one stack at a time (Vite/TS → React ecosystem → UI libs → auth).
3. Fix compile/type/lint fallout per stack before moving on.
4. Run full FE test suite + a short manual smoke.
5. Open a single PR (or stacked PRs if a major is large).

Notes

• Repo already has Dependabot for weekly npm updates at / (see .github/dependabot.yml). This issue is the deliberate full-upgrade pass, including majors Dependabot may not auto-merge/group.
• Keep engines.node (>=20) in mind; do not drop Node 20 support unless coordinated repo-wide.
• Align shared packages (better-auth, zod, typescript) with backend where versions are intentionally shared.

Related

• Backend companion: chore(backend): update all backend dependencies to latest #220
• Agent companion: chore(agent): update all Rust agent dependencies to latest #221

[pullfrog]

Plan: Frontend dependency full refresh (#219)

Bring all catalyst-frontend deps (runtime + dev) to latest feasible versions, update root pnpm-lock.yaml, keep Node >=20, and align shared packages with backend/root where required.

Current baseline (from pnpm outdated --filter catalyst-frontend)

~50 packages behind. Most are minor/patch. Majors present:

Package	Current	Latest	Notes
typescript	6.0.3	7.0.2	Also in root + backend — coordinate with #220
framer-motion	12.38.0	13.1.0	Used widely (App, files UI, plugins)
js-yaml	4.1.1	5.2.3	Single call site: src/utils/pterodactylImport.ts
@testing-library/jest-dom	6.9.1	7.0.1	Imported as /vitest in setup
jsdom	29.1.1	30.0.1	Vitest environment

Already current major lines (no major jump): React 19, Vite 8, Vitest 4, Zod 4, Tailwind 4, React Router 7, ESLint 10, TanStack Query 5, better-auth 1.6.x.

Hygiene: @types/dompurify is deprecated (types ship with dompurify) — remove if types resolve cleanly.

Shared pins (must stay aligned with backend/root):

• better-auth + @better-auth/passkey (~1.6.9 range → latest 1.6.x, currently ~1.6.26)
• zod (~4.4.1 → ~4.4.3)
• typescript (root package.json + FE + BE)

Dependabot (.github/dependabot.yml) only groups dev minor/patch and prod patch — this issue is the deliberate majors + full minor refresh.

---

Approach (single PR preferred; stack only if a major blows up)

Milestone 1 — Audit + branch

1. Branch: pullfrog/219-frontend-deps-latest (or chore/frontend-deps-latest).
2. Capture baseline: pnpm outdated --filter catalyst-frontend (paste into PR).
3. Note workspace: root pnpm-lock.yaml, pnpm-workspace.yaml, Node >=20.

Milestone 2 — Safe minor/patch bulk update

Update non-major stacks in one pass via pnpm --filter catalyst-frontend update (or targeted version bumps in package.json + pnpm install):

• Auth / shared: better-auth, @better-auth/passkey (match backend)
• UI: all @radix-ui/*, lucide-react, sonner, fonts, cmdk, tailwind-merge, class-variance-authority
• Data/UI libs: @tanstack/react-query(+devtools), @tanstack/react-virtual, recharts, date-fns, react-hook-form, @hookform/resolvers, react-router-dom, dompurify, zustand, zod
• Tooling: vite, @vitejs/plugin-react, vitest, eslint + typescript-eslint trio, prettier, postcss/autoprefixer, tailwindcss + @tailwindcss/postcss, @playwright/test, React + @types/react*, globals, eventsource, etc.

After install: pnpm --filter catalyst-frontend run lint && build && test.

Milestone 3 — Majors one stack at a time

Do not land all majors in one untested commit. Order:

1. js-yaml 4 → 5

   • Touch only pterodactylImport.ts (yaml.load / schema API).
   • Confirm egg import still parses JSON + YAML fixtures if any tests exist; otherwise add a small unit case or manual check.

2. @testing-library/jest-dom 6 → 7 + jsdom 29 → 30

   • Keep import '@testing-library/jest-dom/vitest' in setup.
   • Ensure peer @testing-library/dom / @testing-library/react satisfy jest-dom 7.
   • Run pnpm --filter catalyst-frontend run test.

3. framer-motion 12 → 13

   • High blast radius (App.tsx, FileManager/List/Uploader/Editor, dialogs, ticketing plugin).
   • Apply upgrade, fix type/API breakages, smoke animated routes + file manager.

4. typescript 6 → 7 (highest coordination risk)

   • Bump together: root package.json, catalyst-frontend, and preferably catalyst-backend (coordinate with chore(backend): update all backend dependencies to latest #220) so the workspace does not dual-version TS.
   • Re-run FE typecheck via build/lint; fix new strictness only where required.
   • Defer if TS 7 breaks BE/tooling badly — document pin + follow-up, still ship other FE updates.

Milestone 4 — Cleanup

• Remove deprecated @types/dompurify if unused.
• Re-check peers with pnpm install (no unresolved peer warnings that matter).
• pnpm audit --filter catalyst-frontend (or workspace audit); prefer upgrades that clear FE advisories.
• Keep engines.node: ">=20.0.0"; do not raise floor without repo-wide agreement.

Milestone 5 — Verify + PR

Required gates (acceptance criteria):

pnpm install
pnpm --filter catalyst-frontend run lint
pnpm --filter catalyst-frontend run build
pnpm --filter catalyst-frontend run test

Optional: pnpm --filter catalyst-frontend run test:e2e if env allows.

Manual smoke (especially if framer-motion / better-auth / router minors land):

• Login / register / passkey path (authClient.ts)
• Server list → details
• Console + files manager
• Settings / profile

PR body must include:

• Baseline outdated table (before → after)
• Breaking changes + code migrations
• Intentionally skipped majors (reason + follow-up issue)
• Shared-version alignment notes (better-auth, zod, typescript) vs chore(backend): update all backend dependencies to latest #220
• Any Dependabot overlap to close/supersede

---

Risks & constraints

Risk	Mitigation
TS 7 monorepo dual versions	Bump root + FE (+ BE) together, or pin TS 6 and document
framer-motion 13 API drift	Stack-only commit; visual smoke on animated surfaces
js-yaml 5 parse behavior	Isolate to import util; regression on egg YAML
better-auth FE/BE mismatch	Always bump FE+BE auth packages in lockstep
Workspace lockfile churn	Single root lockfile commit; avoid unrelated package bumps unless peers force them
Plugin imports via Vite resolver	Re-run build; plugins resolve through FE node_modules

Out of scope

• Backend-only packages (chore(backend): update all backend dependencies to latest #220) and agent Cargo (chore(agent): update all Rust agent dependencies to latest #221), except shared typescript / better-auth / zod alignment.
• Raising Node engine above 20.
• Dependabot config changes (unless a group blocks this work).

Suggested implementation order (checklist for the Build run)

1. Branch + outdated snapshot
2. Minor/patch bulk + install/lockfile
3. lint / build / test green
4. js-yaml 5 + fix import util
5. jest-dom 7 + jsdom 30 + tests
6. framer-motion 13 + fix compile/UI
7. typescript 7 (coordinated) or document deferral
8. Drop @types/dompurify if safe; audit
9. Final lint/build/test + smoke notes in PR

Effort / PR shape

• Default: one PR chore(frontend): update dependencies to latest.
• Split only if TS 7 or framer-motion 13 needs multi-day migration: PR-A (minors + small majors), PR-B (large major).

Task list (3/3 completed)

• Analyze frontend package.json, lockfile, shared deps, and tooling
• Identify major-bump risks and alignment constraints
• Draft structured plan with milestones and post via report_progress

  ^{｜ Implement plan ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using openai-compatible/ck-grok-4.5 ｜ 𝕏}