Resolve npm audit findings across frontend and backend

[Copilot]

This PR batches the outstanding dependency remediation work for the repo's npm surfaces. It updates the vulnerable frontend and backend dependency chains while keeping the runtime support contract explicit.

• Security dependency updates

  • bumped google-auth-library to ^10.9.1 in both root and backend manifests
  • upgraded frontend vite to ^6.4.3
  • refreshed both lockfiles to remove the vulnerable express/morgan, gaxios/uuid, and vite/esbuild paths

• Deterministic frontend toolchain

  • pinned rollup to 4.59.0 as a direct root dev dependency
  • keeps the resolved Vite toolchain on a patched Rollup release without pulling in the later optional package set

• Runtime contract

  • declared supported Node.js majors in both package manifests
  • documented the same support window in README.md to make the post-upgrade runtime policy explicit

{
  "engines": {
    "node": "^18.0.0 || ^20.0.0 || ^22.0.0"
  },
  "devDependencies": {
    "rollup": "4.59.0"
  }
}

• Fixes Resolve dependency issues #63

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
bingo-string	Ready	Preview	Sep 19, 2026 1:51pm UTC

[Copilot]

Copilot review overview

🟡 Changes recommended

The backend lockfile does not include the newly declared engine metadata.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Backend lockfile omits root engines metadata · New

What changed in this PR

Updates frontend and backend dependencies to remediate npm security findings while defining supported Node.js versions.

Changes:

• Upgrades vulnerable authentication, server, and frontend build dependencies.
• Pins Rollup for deterministic frontend builds.
• Documents Node.js 18, 20, and 22 support.

File	Description
README.md	Documents runtime support.
package.json	Updates frontend dependencies and runtime requirements.
package-lock.json	Refreshes the frontend dependency graph.
backend/​package.json	Updates authentication and runtime requirements.
backend/​package-lock.json	Refreshes backend dependencies.

Files not reviewed (1)

• backend/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.