build: clear all Dependabot alerts and migrate the asset pipeline to Vite

.distignore

@@ -22,7 +22,7 @@
 package.json
 yarn.lock
 composer.lock
-webpack.mix.js
+vite.config.mjs
 postcss.config.js
 tailwind.config.js
 

.github/workflows/deploy-demo.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '24'
 
       - name: Enable Corepack
         run: corepack enable
@@ -39,7 +39,7 @@ jobs:
         run: yarn build:production
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@2.37.0
+        uses: shivammathur/setup-php@2.37.2
         with:
           php-version: '8.3'
 

.github/workflows/deploy.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '24'
 
       - name: Enable Corepack
         run: corepack enable
@@ -44,7 +44,7 @@ jobs:
         run: yarn eslint
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@2.37.0
+        uses: shivammathur/setup-php@2.37.2
         with:
           php-version: '7.4'
 
@@ -70,7 +70,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '24'
 
       - name: Enable Corepack
         run: corepack enable
@@ -82,7 +82,7 @@ jobs:
         run: yarn build:production
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@2.37.0
+        uses: shivammathur/setup-php@2.37.2
         with:
           php-version: '7.4'
 

.gitignore

@@ -53,3 +53,6 @@ dwsync.xml
 bin/act
 .env
 .yarn/
+
+# Playwright MCP artifacts
+.playwright-mcp/

.nvmrc

@@ -1 +1 @@
-v16.14.0
+24.21.0

CLAUDE.md

@@ -36,11 +36,11 @@ docker-compose run --rm web composer test        # Run all tests
 docker-compose run --rm web vendor/bin/pest      # Run all tests directly
 docker-compose run --rm web vendor/bin/pest tests/GtmEventsTest.php  # Single test file
 
-# JavaScript / CSS (run on host, uses Volta node 18)
+# JavaScript / CSS (run on host, uses Volta node 24)
 yarn install
-yarn build              # One-time dev build (Laravel Mix + Tailwind)
+yarn build              # One-time build (Vite + Tailwind)
 yarn build:production   # Production build
-yarn start              # Watch mode with BrowserSync
+yarn start              # Watch mode (rebuilds dist/ on change)
 yarn eslint assets/js/  # ESLint
 
 # Release to WordPress.org SVN
@@ -101,7 +101,7 @@ dist/                          # Built assets (generated, not committed)
 
 - **JS**: Alpine.js with `@alpinejs/persist`
 - **CSS**: Tailwind CSS (admin only, scoped to `#axeptio-app` via `important`), PostCSS with nesting
-- **Build**: Laravel Mix (Webpack), outputs to `dist/`
+- **Build**: Vite, outputs to `dist/` (see `vite.config.mjs`)
 
 ### Coding Standards
 

assets/css/backend/main.css

@@ -1,6 +1,6 @@
-@tailwind base;
-@tailwind components;
-@tailwind utilities;
+@import "tailwindcss/base";
+@import "tailwindcss/components";
+@import "tailwindcss/utilities";
 
 @import "base/base.css";
 @import "base/preflight.css";

docs/deployment/environments.md

@@ -5,17 +5,17 @@ The WordPress plugin has no cloud infrastructure. The two environments are **loc
 
 ## Environment Matrix
 
-| Property          | Local (Dev)                          | WordPress.org (Production)                                 |
-| :---------------- | :----------------------------------- | :--------------------------------------------------------- |
-| Branch            | Any (local)                          | Git tag pushed to GitHub                                   |
-| Trigger           | Manual (`task start` / `yarn watch`) | Git tag push (automated) or `workflow_dispatch` (manual)   |
-| PHP version       | 7.4 (Docker)                         | 7.4 (CI — see [Improvements #3](improvements.md))          |
-| Node version      | 18 (Volta pin)                       | 18 (CI)                                                    |
-| JS build          | `yarn start` (watch) / `yarn build`  | `yarn build:production`                                    |
-| Composer          | `composer install` (with dev)        | `composer install --no-dev --optimize-autoloader`          |
-| Distribution      | Local filesystem                     | WordPress.org SVN + GitHub release `.zip`                  |
-| SVN path          | -                                    | `trunk/` (latest) + `tags/<version>/`                      |
-| Store assets      | -                                    | `release-assets/` → SVN `assets/`                          |
+| Property     | Local (Dev)                          | WordPress.org (Production)                               |
+| :----------- | :----------------------------------- | :------------------------------------------------------- |
+| Branch       | Any (local)                          | Git tag pushed to GitHub                                 |
+| Trigger      | Manual (`task start` / `yarn watch`) | Git tag push (automated) or `workflow_dispatch` (manual) |
+| PHP version  | 7.4 (Docker)                         | 7.4 (CI — see [Improvements #3](improvements.md))        |
+| Node version | 24 (Volta pin)                       | 24 (CI)                                                  |
+| JS build     | `yarn start` (watch) / `yarn build`  | `yarn build:production`                                  |
+| Composer     | `composer install` (with dev)        | `composer install --no-dev --optimize-autoloader`        |
+| Distribution | Local filesystem                     | WordPress.org SVN + GitHub release `.zip`                |
+| SVN path     | -                                    | `trunk/` (latest) + `tags/<version>/`                    |
+| Store assets | -                                    | `release-assets/` → SVN `assets/`                        |
 
 ## Local Development Setup
 
@@ -25,32 +25,32 @@ graph LR
     B --> C[Docker up — PHP 7.4 Alpine]
     C --> D[task composer-install]
     D --> E[yarn install]
-    E --> F[yarn start — webpack watch]
+    E --> F[yarn start — Vite watch]
 ```
 
 ### Docker Environment
 
 The Docker setup is **for local PHP tooling only** (Composer, PHPCS, PHPStan, Pest).
 It is **not** used in GitHub Actions CI.
 
-| Setting              | Value                          |
-| :------------------- | :----------------------------- |
-| Base image           | `php:7.4-alpine`               |
-| PHP extensions       | `bcmath`, `calendar`, `sockets` |
-| Composer             | v2 (installed at image build)  |
-| Working directory    | `/var/www/html/`               |
-| Volume               | `.:/var/www/html` (live mount) |
+| Setting           | Value                           |
+| :---------------- | :------------------------------ |
+| Base image        | `php:7.4-alpine`                |
+| PHP extensions    | `bcmath`, `calendar`, `sockets` |
+| Composer          | v2 (installed at image build)   |
+| Working directory | `/var/www/html/`                |
+| Volume            | `.:/var/www/html` (live mount)  |
 
 **Common local commands (via Taskfile):**
 
-| Task                    | Command                  | Description                              |
-| :---------------------- | :----------------------- | :--------------------------------------- |
-| `task build`            | docker-compose up        | Build and start containers               |
-| `task composer-install` | composer install         | Install PHP dependencies in container   |
-| `task lint-php`         | composer run phpcs       | Run PHPCS in container                   |
-| `task php-stan`         | composer run run-stan    | Run PHPStan static analysis              |
-| `task ssh`              | docker-compose run       | Open shell in container                  |
-| `task stop`             | docker-compose down      | Stop containers                          |
+| Task                    | Command               | Description                           |
+| :---------------------- | :-------------------- | :------------------------------------ |
+| `task build`            | docker-compose up     | Build and start containers            |
+| `task composer-install` | composer install      | Install PHP dependencies in container |
+| `task lint-php`         | composer run phpcs    | Run PHPCS in container                |
+| `task php-stan`         | composer run run-stan | Run PHPStan static analysis           |
+| `task ssh`              | docker-compose run    | Open shell in container               |
+| `task stop`             | docker-compose down   | Stop containers                       |
 
 ## WordPress.org Release Process
 
@@ -78,24 +78,24 @@ sequenceDiagram
 
 Two files control which paths are excluded from the release package, depending on how the release is triggered:
 
-| File              | Used by                        | Has inline comments |
-| :---------------- | :----------------------------- | :------------------ |
-| `.distignore`     | CI pipeline (`deploy.yml`)     | Yes                 |
-| `exclusions.txt`  | Manual `task release` command  | No                  |
+| File             | Used by                       | Has inline comments |
+| :--------------- | :---------------------------- | :------------------ |
+| `.distignore`    | CI pipeline (`deploy.yml`)    | Yes                 |
+| `exclusions.txt` | Manual `task release` command | No                  |
 
 Both files must be kept in sync. See [Improvements](improvements.md) for known gaps.
 
 Key paths excluded from the release package:
 
-| Excluded path       | Reason                                          |
-| :------------------ | :---------------------------------------------- |
+| Excluded path       | Reason                                            |
+| :------------------ | :------------------------------------------------ |
 | `assets/`           | Raw source assets (compiled output is in `dist/`) |
-| `node_modules/`     | JS dependencies                                 |
-| `release-assets/`   | Moved to SVN `assets/` separately               |
-| `releases/`         | Temporary SVN checkout directory                |
-| `tmp/`              | Temporary build output                          |
-| `.git/`, `.github/` | VCS and CI config                               |
-| Dev config files    | `phpcs.xml`, `phpstan.neon.dist`, etc.          |
+| `node_modules/`     | JS dependencies                                   |
+| `release-assets/`   | Moved to SVN `assets/` separately                 |
+| `releases/`         | Temporary SVN checkout directory                  |
+| `tmp/`              | Temporary build output                            |
+| `.git/`, `.github/` | VCS and CI config                                 |
+| Dev config files    | `phpcs.xml`, `phpstan.neon.dist`, etc.            |
 
 ### SVN Structure on WordPress.org