chore(frontend): consolidate dependency updates

[jeffspahr]

Summary

• update http-proxy-middleware to 3.0.7 and migrate the mock backend proxy event configuration
• update js-yaml to 4.2.0 and replace the removed safeLoad/safeDump APIs
• update Vite to 8.0.16, Storybook's Vite integration to 10.4.6, and the React plugin to 5.2.0
• regenerate the frontend lockfile with the npm 11.17.0 toolchain pinned by chore(frontend): pin npm 11.17.0 #13553

This replaces Dependabot PRs #13550, #13548, and #13528, whose branches predate the pinned npm toolchain.

Impact

The frontend build and development toolchain move to Vite 8. YAML parsing and serialization retain their existing safe behavior using the js-yaml 4 API. The mock metadata proxy uses the http-proxy-middleware 3 event configuration.

Verification

• Node 24.14.0 and npm 11.17.0: npm ci
• lockfile drift check against origin/master
• npm run build
• npm run build:storybook
• frontend formatting, lint, typecheck, mock-backend typecheck, React peer check, and server TypeScript build
• mock backend startup on port 3001
• 16 js-yaml-affected test files: 193 tests passed
• timing-sensitive UI regression subset: 40 tests passed
• isolated server job regression test passed

The local full-coverage run encountered long-running UI timing flakes and the existing hidden-worktree artifact fixture issue. The same UI hangs reproduce on unmodified master; targeted affected suites pass and CI remains the authoritative full-suite check.

[google-oss-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[Copilot]

Pull request overview

Consolidates several frontend dependency upgrades (Vite/Storybook, js-yaml, http-proxy-middleware) and updates the frontend + mock-backend code to match the new upstream APIs, with an accompanying lockfile regeneration using the pinned npm toolchain.

Changes:

• Upgrade Vite to 8.0.16 (plus Storybook Vite integration and React plugin) and refresh the npm lockfile.
• Migrate js-yaml usage from removed safeLoad/safeDump APIs to load/dump across runtime code and tests.
• Migrate mock backend proxy hook configuration to the http-proxy-middleware v3 on: { ... } event format.

Reviewed changes

Copilot reviewed 25 out of 26 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
frontend/src/pages/RunDetailsRouter.tsx	Switch YAML serialization to JsYaml.dump for v2 run pipeline specs.
frontend/src/pages/RunDetailsRouter.test.tsx	Update tests to parse YAML via JsYaml.load.
frontend/src/pages/RecurringRunDetailsV2.test.tsx	Update test fixture YAML parsing to JsYaml.load.
frontend/src/pages/RecurringRunDetailsRouter.tsx	Switch YAML serialization to JsYaml.dump for recurring run pipeline specs.
frontend/src/pages/RecurringRunDetailsRouter.test.tsx	Update tests to parse YAML via JsYaml.load.
frontend/src/pages/PipelineDetailsV1.test.tsx	Update YAML serialization in test data to JsYaml.dump.
frontend/src/pages/PipelineDetailsTest.test.tsx	Update YAML parsing in tests to JsYaml.load (and simplify formatting).
frontend/src/pages/PipelineDetails.tsx	Replace safeLoad/safeDump usage with load/dump in pipeline template handling and graph generation.
frontend/src/pages/PipelineDetails.test.tsx	Update YAML parsing fixtures to JsYaml.load (and simplify formatting).
frontend/src/pages/NewRunV2.tsx	Update pipeline spec parsing when constructing v2 run payloads to JsYaml.load.
frontend/src/pages/NewRunV2.test.tsx	Update expectations/fixtures to use JsYaml.load.
frontend/src/pages/NewRunSwitcher.tsx	Switch YAML serialization to JsYaml.dump for run/recurring-run derived manifests.
frontend/src/pages/NewRunSwitcher.test.tsx	Update fixtures to parse YAML via JsYaml.load.
frontend/src/pages/functional_components/RecurringRunDetailsV2FC.test.tsx	Update test fixture YAML parsing to JsYaml.load.
frontend/src/pages/tests/newRunTestFixtures.ts	Update shared test fixtures to parse YAML via JsYaml.load.
frontend/src/lib/v2/WorkflowUtils.ts	Update YAML parsing implementation to js-yaml v4 API and avoid double-parsing.
frontend/src/lib/v2/WorkflowUtils.test.ts	Update tests to use named js-yaml exports (dump, loadAll).
frontend/src/lib/v2/StaticFlow.test.ts	Update YAML parsing in tests to named load.
frontend/src/lib/v2/DynamicFlow.test.ts	Update YAML parsing in tests to named load.
frontend/src/hooks/usePipelineVersionTemplate.ts	Switch YAML serialization to JsYaml.dump for pipeline version template hook.
frontend/src/components/tabs/RuntimeNodeDetailsV2.test.tsx	Update tests to use named js-yaml exports (dump, loadAll).
frontend/src/components/PodYaml.tsx	Switch YAML serialization to JsYaml.dump for pod info/events.
frontend/src/components/PipelineSpecTabContent.tsx	Update editor normalization to dump(load(...)) with js-yaml v4 named exports.
frontend/package.json	Bump http-proxy-middleware, js-yaml, Vite, Storybook Vite integration, and React plugin versions.
frontend/package-lock.json	Regenerate lockfile for the upgraded dependencies/toolchain.
frontend/mock-backend/mock-api-server.ts	Migrate proxy request hook to http-proxy-middleware v3 on.proxyReq event config.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jeffspahr. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• frontend/OWNERS
• test/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment