EPBDS-16211 H9: burn the dev-tooling audit down to zero, and record today's decisions

[AlexSamBY]

Audit: 28 → 0

	before	after
npm audit	28 (2 critical, 11 high, 12 moderate, 3 low)	0
npm audit --omit=dev	0	0

• npm audit fix moved 45 lock entries inside their declared ranges (Babel, PostCSS, browserslist, svgo, axios, ws, …). It closed 21 findings, both criticals among them (shell-quote, websocket-driver).
• webpack-dev-server 5 → 6 closed webpack-dev-server, sockjs, uuid and qs: Express 5 resolves qs 6.16, where Express 4 pinned ~6.14.0. Only npm start uses the dev server, since Playwright builds the demo and serves it statically. Checked in the running demo: it compiles, hot-reloads over ws, and logs no error.
• react-router and react-router-dom 6 → 7.18.4. The demo is the only user; 8.x needs React ≥ 19.2.7. Version 7 wraps location updates in startTransition by default. That brought back the extra history entry NavTabs.history.test.js pins: after a click the tabs were still given the previous location's tab for a render, StandaloneTabs reported it, and NavTabs navigated back to /. Traced with the tab reports logged. The demo now mounts BrowserRouter with useTransitions={false}, which is 6's synchronous update. Checked in the running demo: two tab clicks push two history entries, and Back then Forward push none. The test also loads the router after installing Node's TextEncoder, which 7 reads at module load and jsdom does not provide. That is scoped to this suite, the only one that loads the router.
• moment dev copy ~2.29.4 → ~2.31.0 (GHSA-4p3w-j4w9-5jqw, a path traversal through a crafted locale name). The peer range stays ^2.29.4: the library never calls moment.locale, so the advisory is not reachable through it. Raising a host's floor is a consumer-facing decision this PR does not take.

The published package did not change

build-lib was run before and after, and all 282 files it publishes (dist/ and the root static/ payload) are byte-identical. That includes static/all.css at dcdb0a40…, the hash the plan has recorded since 2026-09-17. Two builds of the same tree were identical first, so the comparison is meaningful.

The plan

docs/UPGRADE-PLAN.md records the burn-down in the §10 gate table and the Appendix B baseline. It also records the decisions taken today:

• TypeScript E2/E3 tail: GO (§9.6 governance).
• moment: keep (§9.7-F2).
• ESM: not now (§9.7-F3). Both motivations are gone: script-tag consumption is unsupported, and nothing is installed twice since dependencies was emptied.
• Form-stack bump: postponed, and no longer a React 19 prerequisite (§9.7-F4, §8 gate 2). No host installs the form stack since the 2026-09-22 trim, so its react ^18 peer caps nobody, and the React 19 advisory job runs the whole suite on 6.5.9 green. The cost measured today on 7.0.1 is recorded:
  • commits at mount 107 → 118 and translate calls 1013 → 1046 over the 38 examples;
  • defaultValue is missing from the first render;
  • 5 tests fail, including a popup regression.

It also marks Phase 6 done in §10, and corrects two stale §8 rows (the semantic-ui-react blocker, gone with the package; propTypes importers 40 → 31).

Gates

All exited 0:

• lint:js, lint:css, typecheck;
• css:fixture:check, docs:props:check, docs:views:check;
• test:env-flags, test:coverage, build, build-lib;
• test:react16 and test:react17, 2907 tests on each;
• npx jest, 2907 tests;
• test:e2e, 41 Playwright tests;
• the manifest contract.

🤖 Generated with Claude Code