chore: consolidate Dependabot dependency updates

[SHIVAM (ShivamGoyal03)]

Summary

Consolidates the currently open Dependabot updates into one tested pull request:

• Updates frontend dependencies and lockfile, including Excalidraw/Mermaid, nanoid, Vite, React plugin, Babel, browserslist, baseline-browser-mapping, PostCSS, esbuild, and related transitive packages.
• Updates actions/github-script from v7.1.0 to v9.0.0 using the verified immutable commit SHA 3a2844b7e9c422d3c10d287c895573f7108da1b3.
• Intended to supersede the open Dependabot PRs Bump @excalidraw/mermaid-to-excalidraw and @excalidraw/excalidraw in /frontend #24, Bump uuid and @excalidraw/excalidraw in /frontend #28, Bump esbuild, @vitejs/plugin-react and vite in /frontend #29, Bump @babel/core from 7.29.0 to 7.29.7 in /frontend #30, Bump actions/github-script from 7.1.0 to 9.0.0 in the github-actions group #32, Bump postcss from 8.5.6 to 8.5.28 in /frontend #33, Bump nanoid from 5.1.6 to 5.1.16 in /frontend #34, Bump mermaid from 11.12.3 to 11.17.2 in /frontend #35, Bump baseline-browser-mapping from 2.9.19 to 2.11.21 in /frontend #36, Bump browserslist from 4.28.1 to 4.28.9 in /frontend #37, and Bump vite from 7.3.1 to 7.3.6 in /frontend #39.

Validation performed

• python -m pytest -q — 137 passed, 10 skipped (Azure-dependent tests)
• python run_local.py scenarios/ecommerce.yaml — completed successfully and generated output/review_bundle.json
• npm --prefix frontend run build — completed successfully with Vite 8.0.16
• API happy path — health, review, upload, PNG download, Excalidraw download, SPA serving, invalid run ID, and empty input checks passed

Notes

The skipped tests require external Azure/LLM services and were not run against live credentials.

[Copilot]

🟡 Changes recommended

The Vite 8 upgrade introduces stricter Node engine requirements that aren’t currently made explicit in frontend/package.json, which can lead to install/build failures for contributors or CI using older Node versions.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Consolidates multiple Dependabot updates into a single PR by upgrading key frontend build/runtime dependencies (Excalidraw, nanoid, Vite/plugin-react and transitive lockfile updates) and bumping actions/github-script in the issue-management workflow to a pinned v9 commit.

Changes:

• Bumped @excalidraw/excalidraw and nanoid in the frontend.
• Upgraded the frontend toolchain to vite@8 and @vitejs/plugin-react@5.2.0, refreshing package-lock.json with updated transitive dependencies.
• Updated .github/workflows/issue-management.yml to use actions/github-script v9 pinned by immutable SHA.

File summaries

File	Description
frontend/package.json	Updates top-level frontend dependency and devDependency versions (Excalidraw, nanoid, Vite/plugin-react).
frontend/package-lock.json	Regenerates the lockfile to reflect updated frontend dependencies and new transitive graph (e.g., Vite 8 + rolldown).
.github/workflows/issue-management.yml	Bumps actions/github-script to the pinned v9.0.0 commit SHA for the issue automation job.

Review details

Files not reviewed (1)

• frontend/package-lock.json: Generated file

• Files reviewed: 2/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[SHIVAM (ShivamGoyal03)]

Addressed in bb34ba6. Added an explicit engines field to frontend/package.json declaring "node": "^20.19.0 || >=22.12.0", matching the constraint that Vite 8 and rolldown 1.0.3 declare in the lockfile. Also bumped the Dockerfile.web frontend build stage from node:20-slim to node:22-slim and documented the requirement in the prerequisites section of AGENTS.md.

[SHIVAM (ShivamGoyal03)]

Addressed in bb34ba6. Confirmed the lockfile contains zero node_modules/rollup* entries after the Vite 8 upgrade (Vite 8 bundles with rolldown instead), so the override was inert. Removed it and regenerated the lockfile; the only resulting change was the new engines entry, which confirms the override had no effect on resolution. The remaining nanoid, immutable, and dompurify overrides were verified as still present in the dependency tree and were kept.

[SHIVAM (ShivamGoyal03)]

Both Copilot review comments have been addressed in bb34ba6.

1. Missing Node engine declaration — Added engines: { "node": "^20.19.0 || >=22.12.0" } to frontend/package.json, matching what Vite 8.0.16 and rolldown 1.0.3 declare. Also bumped the Dockerfile.web frontend build stage to node:22-slim and documented the requirement in AGENTS.md.

2. Unused rollup override — Verified the lockfile has no node_modules/rollup* entries after the Vite 8 upgrade, then removed the override. Regenerating the lockfile produced no resolution changes, confirming it was inert. The nanoid, immutable, and dompurify overrides remain and are still active in the tree.

Re-validation after the changes

Check	Result
python -m pytest -q	137 passed, 10 skipped
npm ci + npm run build	Passed (Vite 8.0.16)
API health / review / PNG download / SPA	All 200