fix: refresh dependencies and keep React versions aligned

.changelog/NEXT.md

@@ -40,6 +40,8 @@
 
 ## Changed
 
+- Refresh visualization, routing, icons, Tailwind/Vite, Chalk, PM2, SQL test helpers, Supertest, and Vitest dependencies with compatible patch/minor releases.
+
 - **[issue-155] PostgreSQL tooling cutover** — Indexing, maintenance, sample generation, startup and schema migrations now use PostgreSQL with JSON read fallback; removed the native SQLite runtime and kept legacy metadata import explicit and read-only.
 - **[issue-153] PostgreSQL local data and enrichment** — Local overrides, favorites/tags, discovery dismissals, media, augmentation, death metadata, and refresh writes now preserve user edits and concurrent updates in PostgreSQL, with a read-only SQLite metadata import and JSON rebuild parity coverage.
 
@@ -64,6 +66,8 @@
 
 ## Fixed
 
+- Keep React DOM aligned with React 19.3.1 so the client starts successfully; group future React patch/minor updates and run the client component tests in CI.
+
 - **[issue-161] Cancel abandoned SSE operations** — Disconnecting an owned ancestry update, hints, bulk discovery, or browser scrape now cancels work and releases its operation slot without writing to the closed stream; intentional background discovery continues.
 - **[issue-173] SQLite migrations gate server readiness** — the HTTP listener now starts only after all pending migrations succeed; a migration failure closes SQLite and makes the process exit unsuccessfully instead of serving against an outdated schema.
 - **[issue-174] Production API integration coverage** — API integration tests now exercise the mounted production routers and assert search filters, pagination, relationship writes, AI discovery failures and batch limits, and persisted favorites through isolated adapters.
@@ -94,6 +98,8 @@
 
 ## Removed
 
+- Remove the unused MSW development dependency and its transitive packages.
+
 - Removed the unused Zustand client dependency and its lockfile entries.
 - Removed the unused root `concurrently` development dependency and its lockfile dependency tree.
 - Socket.IO: removed server (`socket.service.ts`, `socket.io` dep) and client (`socket.ts`, `useSocket.ts` hooks), replaced with synchronous API + existing SSE

.github/dependabot.yml

@@ -5,6 +5,14 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 10
+    groups:
+      react:
+        patterns:
+          - react
+          - react-dom
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/workflows/ci.yml

@@ -80,6 +80,9 @@ jobs:
       - name: Run unit tests
         run: npm run test:unit
 
+      - name: Run client component tests
+        run: npm test -w client -- --run
+
       - name: Upload coverage
         uses: codecov/codecov-action@v7
         if: always()

PLAN.md

@@ -18,7 +18,7 @@ For phase-by-phase implementation history, see [docs/roadmap.md](./docs/roadmap.
 
 ### Cleanup & Security
 
-- [ ] Routine dep refresh — 22 packages outdated at last audit (`@tailwindcss/vite`, `happy-dom`, `msw`, `vite`, `vitest`, `typescript`, `lucide-react`, etc.). Patch/minor only; defer React 19 (see Future).
+- [x] Routine dep refresh — land reviewed bot updates, align React/React DOM, refresh remaining compatible client dependencies, and remove unused MSW.
 - [ ] Remove `LegacyAugmentation` interface + `migrateAugmentation` / `isLegacyFormat` helpers in `augmentation.service.ts` once no callers remain.
 - [ ] Deprecate non-db-scoped favorites routes (`GET/POST/PUT/DELETE /:personId` in `favorites.routes.ts:166-214`) — duplicates db-scoped endpoints.
 - [x] [navigate-allowlist-ssrf-guard] Add allowlist guard on `browserService.navigateTo()` — currently accepts arbitrary URLs (SSRF risk); restrict to known genealogy domains.
@@ -74,7 +74,6 @@ For phase-by-phase implementation history, see [docs/roadmap.md](./docs/roadmap.
 
 ## Future / Ideas
 
-- React 19 upgrade — currently on 18.3 (and react-leaflet 4→5). Audit hooks behavior, types, react-leaflet breaking changes; gate behind a branch.
 - Stats trends over time — recent `TreeStatsPage` is a snapshot; chart per-database growth across audit runs.
 - Mobile-first review flow — recent mobile fixes (40px touch targets, card overflow) suggest demand for a phone-friendly verification queue.
 - GEDCOM import/export — listed as a non-goal in GOALS.md; revisit if user demand emerges.

client/package.json

@@ -10,27 +10,27 @@
   },
   "dependencies": {
     "@fsf/shared": "*",
-    "d3": "^7.9.0",
+    "d3": "^7.9.2",
     "leaflet": "^1.9.4",
-    "lucide-react": "^1.48.0",
+    "lucide-react": "^1.71.0",
     "portos-ai-toolkit": "^0.8.4",
     "react": "^19.3.1",
-    "react-dom": "^19.3.0",
+    "react-dom": "^19.3.1",
     "react-hot-toast": "^2.6.1",
     "react-leaflet": "^5.0.0",
-    "react-router-dom": "^7.18.4",
+    "react-router-dom": "^7.18.5",
     "socket.io-client": "^4.8.3"
   },
   "devDependencies": {
-    "@tailwindcss/vite": "^4.3.3",
-    "@testing-library/react": "^16.3.2",
+    "@tailwindcss/vite": "^4.3.5",
+    "@testing-library/react": "^16.3.3",
     "@types/d3": "^7.4.3",
     "@types/leaflet": "^1.9.22",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
-    "tailwindcss": "^4.3.1",
+    "@vitejs/plugin-react": "^6.3.0",
+    "tailwindcss": "^4.3.5",
     "typescript": "^7.0.2",
-    "vite": "^8.3.5"
+    "vite": "^8.3.7"
   }
 }