[amar-python]

Part of #132: everything except the zod major upgrade. Built on the product owner's decision of 28 Oct to fix #132 before the #60 dry run, so that the clean-VM evidence covers patched code.

Result

npm audit: 17 → 1.

• Before: 6 critical, 8 high, 3 moderate.
• After: 1 high, zod <4.6.6, which needs zod 4 (a major version). That's left for a follow-up, as Frontend dependencies: npm audit reports 6 critical (TanStack Start XSS) and 8 high #132 proposes.

What changes

• package-lock.json: non-breaking updates within the existing package.json ranges. 66 package versions change.
  • @tanstack/react-start 1.168.42 → 1.169.4, plus the start-* packages. This fixes the critical unauthenticated reflected XSS.
  • shell-quote 1.10.0 → 1.12.0 (critical).
  • vite 8.2.1 → 8.3.5, launch-editor, undici 8.10.0 → 8.12.3, seroval 1.6.2 → 1.7.2, brace-expansion, js-yaml, source-map-js (all high).
  • Others carried along: @tanstack/react-router 1.170.25 → 1.170.46, rolldown 1.2.3 → 1.2.15, postcss, and diff 8 → 9 (a sub-dependency its parent allows).
• package.json: vitest and @vitest/ui move from ^4.1.10 to ^4.1.12, which fixes the moderate path traversal in @vitest/mocker. npm also added the missing newline at the end of the file.
• src/routes/__root.tsx: the newer router types errorComponent's error as unknown, so the root error component now accepts unknown. reportLovableError already takes unknown.

How the lock was produced

• npm 10.9.9's npm audit fix crashes with an internal error: Cannot read properties of null (reading 'edgesOut').
• So the fix was applied with npm 11, then normalised with npm 10 (npm install --package-lock-only).
• Without that second step, npm 10's npm ci fails again with the Frontend package-lock.json out of sync: clean npm ci fails, blocking the #60 bundle build #130 error (Missing: lru-cache@11.5.3), because npm 11 lays out that nested package differently.

Checks

Run on a clean install with npm 10.9.9 / Node 22.23.4, the same toolchain as the dev machine's WSL:

• npm ci: 506 packages, exit 0.
• npm audit: 1 high (zod).
• vitest: 12 files, 139 passed.
• tsc --noEmit: exit 0.
• NITRO_PRESET=node-server build: OK.
• Browser check (Playwright, production build):
  • /auth shows "Sign in to CSV Migrator" with the 3 fields;
  • / redirects to /auth when signed out;
  • /auth, / and /audit all return 200.
  • The page logs React errors #520 and #422, identically on main's dependencies, so they're pre-existing and not from this update. They're logged as Frontend logs React hydration errors #520/#422 on /auth in production builds (pre-existing) #133.

After merging

Rebuild the #60 bundle (runbook A4), so the dry run uses this code.

Still open on #132

The zod 3 → 4 upgrade.

---

Generated by Claude Code