chore(deps): modernize toolchain (Vite 8, TS 6, ESLint 10, Hono) + cut 14 direct deps (−139 packages)

Toolchain to the latest working majors:
- Vite 6→8 (Rolldown/Oxc), @vitejs/plugin-react 4→6, vite-plugin-dts 4→5
  (rollupTypes→bundleTypes via @microsoft/api-extractor), TypeScript 5.7→6.0.
- ESLint 9→10. eslint-plugin-react has no v10 release (it calls the removed
  context.getFilename()), so React linting moves to @eslint-react/eslint-plugin
  (flat-config, v10-native); eslint-plugin-react-hooks stays the hooks authority
  and @eslint-react's overlapping hook rules are disabled so each is reported once.

Server runtime majors:
- zod 3→4, redis 5→6 (pinned RESP2 to preserve the raw sendCommand reply shapes
  this code parses), pino 9→10, dotenv 16→17, ulid 2→3.
- Express 5 → Hono 4 + @hono/node-server (both zero-runtime-dep), dropping
  express/cors/cookie/pino-http and ~18 transitives. Routes, status codes, bodies,
  headers, owner-cookie HMAC, CORS policy, zod error envelopes and the yjs WS relay
  are preserved; buildApp still returns an unstarted http.Server.

Cuts:
- uuid → an embed-safe crypto.getRandomValues RFC-4122 v4 (works in any context,
  unlike crypto.randomUUID which needs a secure context an embed can't assume).
- cmdk + the unused command component; @ionic/react → a 45-line vendored
  platform.ts (its Stencil runtime was in the initial bundle for UA checks only) —
  webapp initial bundle nearly halved.
- packages/ui: drop dead @vitest/coverage-v8 (no coverage config/script there).

~50 deps bumped to latest (modulo the repo's >24h minimumReleaseAge).

Verified: pnpm install --frozen-lockfile; pnpm lint 0 errors; pnpm knip clean;
builds (library single-entry incl. rolled .d.ts, webapp, server, vscode, ui types
+ stories typecheck); size-limit within budget (webapp initial 34.65/35 kB);
tests library 1222 / webapp 256 / server 150 (Docker) / ui 37.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: FelixTJDietrich

.github/workflows/pr-health-checks.yml

@@ -213,14 +213,14 @@ jobs:
           # Browser-specific key: the chromium and firefox jobs share this cache
           # path but install different browsers, so they must not share a key
           # (a firefox-only cache would make this job skip its chromium install).
-          key: playwright-chromium-${{ runner.os }}-v1.59.1-${{ hashFiles('standalone/webapp/package.json') }}
+          key: playwright-chromium-${{ runner.os }}-v1.61.1-${{ hashFiles('standalone/webapp/package.json') }}
 
       - name: Install Playwright browsers
         if: steps.playwright-cache.outputs.cache-hit != 'true'
         # Invoke @playwright/test's own CLI (not `pnpm exec playwright`): the
-        # webapp also has `playwright@1.61` for Storybook's vitest browser runner,
-        # so the bare `playwright` bin resolves to 1.61 and installs browsers the
-        # 1.59.1 test runner can't find. cli.js installs 1.59.1's browsers.
+        # webapp also has the `playwright` package (Storybook's vitest browser
+        # runner), and both ship a `playwright` bin, so the bare bin can resolve
+        # to the wrong package. cli.js pins the install to @playwright/test.
         run: pnpm --filter @tumaet/webapp exec node node_modules/@playwright/test/cli.js install chromium
 
       # Shared with perf-firefox-tests; the dpkg-lock hang it guards is
@@ -232,8 +232,8 @@ jobs:
 
       - name: Run E2E tests
         # Use the test:e2e script (node …/@playwright/test/cli.js): running via
-        # `pnpm exec playwright test` picks up the 1.61 runner against 1.59.1 test
-        # files → "did not expect test.describe()".
+        # `pnpm exec playwright test` can pick up the `playwright` package's CLI
+        # (bin collision) instead of @playwright/test's test runner.
         run: pnpm --filter @tumaet/webapp run test:e2e
 
       # No chromium document-growth budget: the metric is engine-independent and
@@ -286,12 +286,13 @@ jobs:
           path: ~/.cache/ms-playwright
           # Firefox-specific key — must differ from the chromium jobs' key (same
           # cache path, different browser) so neither poisons the other's cache.
-          key: playwright-firefox-${{ runner.os }}-v1.59.1-${{ hashFiles('standalone/webapp/package.json') }}
+          key: playwright-firefox-${{ runner.os }}-v1.61.1-${{ hashFiles('standalone/webapp/package.json') }}
 
       - name: Install Playwright Firefox
         if: steps.playwright-cache.outputs.cache-hit != 'true'
-        # @playwright/test's own CLI, so Firefox matches the 1.59.1 test runner
-        # (see the e2e job's install step for why `pnpm exec playwright` is wrong).
+        # @playwright/test's own CLI, so the install targets the test runner's
+        # package — both packages ship a `playwright` bin (see the e2e job's
+        # install step for why `pnpm exec playwright` is wrong).
         run: pnpm --filter @tumaet/webapp exec node node_modules/@playwright/test/cli.js install firefox
 
       # Shared with e2e-tests; the dpkg-lock hang it guards is documented in
@@ -393,7 +394,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: mcr.microsoft.com/playwright:v1.59.1-noble
+      image: mcr.microsoft.com/playwright:v1.61.1-noble
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.github/workflows/update-visual-baselines.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: mcr.microsoft.com/playwright:v1.59.1-noble
+      image: mcr.microsoft.com/playwright:v1.61.1-noble
     steps:
       - name: Checkout target branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

docs/package.json

@@ -18,9 +18,9 @@
     "@docusaurus/faster": "3.10.1",
     "@docusaurus/preset-classic": "3.10.1",
     "@docusaurus/theme-mermaid": "3.10.1",
-    "@easyops-cn/docusaurus-search-local": "0.55.1",
+    "@easyops-cn/docusaurus-search-local": "0.55.2",
     "@mdx-js/react": "3.1.1",
-    "@mermaid-js/layout-elk": "0.2.1",
+    "@mermaid-js/layout-elk": "0.2.2",
     "@tumaet/apollon": "workspace:*",
     "@xyflow/react": "catalog:",
     "clsx": "catalog:",

docs/tsconfig.json

@@ -1,8 +1,11 @@
 {
   "extends": "@docusaurus/tsconfig",
   "compilerOptions": {
-    "baseUrl": ".",
-    "jsx": "react-jsx"
+    "jsx": "react-jsx",
+    // @docusaurus/tsconfig (the external base) still sets `baseUrl`, which TS 6.0
+    // flags as a hard deprecation error (TS5101). We can't edit that base, so opt
+    // into the TS-sanctioned escape hatch until Docusaurus drops baseUrl.
+    "ignoreDeprecations": "6.0"
   },
   "include": ["src/", "docusaurus.config.ts", "sidebars.*.ts"]
 }

knip.json

@@ -15,7 +15,7 @@
         "tests/**/*.test.{ts,tsx}"
       ],
       "project": ["src/**/*.{ts,tsx}", "tests/**/*.{ts,tsx}"],
-      "ignoreDependencies": ["@tailwindcss/vite", "@vitest/coverage-v8"]
+      "ignoreDependencies": ["@tailwindcss/vite"]
     },
     "standalone/webapp": {
       "entry": [
@@ -36,13 +36,11 @@
       ]
     },
     "standalone/server": {
-      "entry": ["src/workers/*.{ts,mjs}"],
-      "ignoreDependencies": ["@types/express-serve-static-core"]
+      "entry": ["src/workers/*.{ts,mjs}"]
     },
     "vscode-extension": {
       "entry": ["webview-vite.config.ts"],
-      "ignoreBinaries": ["vsce"],
-      "ignoreDependencies": ["babel-plugin-react-compiler"]
+      "ignoreBinaries": ["vsce"]
     },
     "vscode-extension/editor": {
       "entry": ["src/index.tsx"],

library/eslint.config.mjs

@@ -2,7 +2,7 @@
 import globals from "globals"
 import pluginJs from "@eslint/js"
 import tseslint from "typescript-eslint"
-import reactPlugin from "eslint-plugin-react"
+import eslintReact from "@eslint-react/eslint-plugin"
 import reactHooks from "eslint-plugin-react-hooks"
 
 /** @type {import('eslint').Linter.Config[]} */
@@ -12,19 +12,28 @@ export default [
   { languageOptions: { globals: globals.browser } },
   pluginJs.configs.recommended,
   ...tseslint.configs.recommended,
-  reactPlugin.configs.flat.recommended,
-  reactPlugin.configs.flat["jsx-runtime"],
+  // recommended-typescript disables the prop-types rules TypeScript already enforces.
+  eslintReact.configs["recommended-typescript"],
   {
-    settings: { react: { version: "detect" } },
     plugins: { "react-hooks": reactHooks },
-    // eslint-plugin-react-hooks v7 flat preset — bundles the React Compiler
-    // lint rules (preserve-manual-memoization, refs, purity, immutability,
-    // set-state-in-effect, …). exhaustive-deps stays at warn: the only
+    // eslint-plugin-react-hooks is the hooks / React-Compiler authority here
+    // (preserve-manual-memoization, refs, purity, immutability,
+    // set-state-in-effect, …). @eslint-react ships its own copies of those hook
+    // rules in `recommended-typescript`; turn them off so each concern is
+    // reported once, by react-hooks. exhaustive-deps stays at warn: the only
     // remaining exhaustive-deps suppression is Apollon.tsx's mount-once lifecycle.
     rules: {
       ...reactHooks.configs.flat.recommended.rules,
+      "@eslint-react/error-boundaries": "off",
+      "@eslint-react/exhaustive-deps": "off",
+      "@eslint-react/purity": "off",
+      "@eslint-react/rules-of-hooks": "off",
+      "@eslint-react/set-state-in-effect": "off",
+      "@eslint-react/set-state-in-render": "off",
+      "@eslint-react/static-components": "off",
+      "@eslint-react/unsupported-syntax": "off",
+      "@eslint-react/use-memo": "off",
       "react-hooks/exhaustive-deps": "warn",
-      "react/prop-types": "off",
       "no-console": "error",
       // Allow intentionally-unused `_`-prefixed bindings.
       "@typescript-eslint/no-unused-vars": [

library/lib/components/popovers/edgePopovers/ActivityDiagramEdgeEditPopover.tsx

@@ -32,6 +32,7 @@ export const ActivityDiagramEdgeEditPopover: React.FC<PopoverProps> = ({
         sideElements={[
           handleSwap && (
             <IconButton
+              key="swap-source-target"
               ariaLabel="Swap source and target"
               tooltip="Swap source and target"
               onClick={handleSwap}

library/lib/components/popovers/edgePopovers/BPMNDiagramEdgeEditPopover.tsx

@@ -47,6 +47,7 @@ export const BPMNDiagramEdgeEditPopover: React.FC<PopoverProps> = ({
         sideElements={[
           handleSwap && (
             <IconButton
+              key="swap-source-target"
               ariaLabel="Swap source and target"
               tooltip="Swap source and target"
               onClick={handleSwap}

library/lib/components/popovers/edgePopovers/ClassDiagramEdgeEditPopover.tsx

@@ -55,6 +55,7 @@ export const EdgeEditPopover: React.FC<PopoverProps> = ({ elementId }) => {
         sideElements={[
           handleSwap && (
             <IconButton
+              key="swap-source-target"
               ariaLabel="Swap source and target"
               tooltip="Swap source and target"
               onClick={handleSwap}

library/lib/components/popovers/edgePopovers/ComponentDiagramEdgeEditPopover.tsx

@@ -46,6 +46,7 @@ export const ComponentEdgeEditPopover: React.FC<PopoverProps> = ({
         sideElements={[
           handleSwap && (
             <IconButton
+              key="swap-source-target"
               ariaLabel="Swap source and target"
               tooltip="Swap source and target"
               onClick={handleSwap}