SYN-674: Resolve remaining dependency vulnerabilities

[KARSE22]

SYN-674

• CRA → Vite: Removes the dependency chain behind SYN-674's high findings.
• tsup → esbuild: Simplifies the build and removes the need for the esbuild override.
• ESLint 9.39.5: Fixes its finding; preset and rule cleanup are additional improvements.
• Tests and CI: Strengthens error assertions and uses npm ci for reproducible installs.

Library runtime logic, exports, dependency ranges, and React peers are unchanged.

Testing

• Clean installs, 16 tests, lint, builds, and CI pass on Node 20/22/24. Both npm audits returned zero vulnerabilities.
• Chromium development and production checks passed with mocked Lob responses. Live API calls and other browsers remain untested.

Compatibility and validation details

• CommonJS/ESM JavaScript matches main except for trailing newlines. Packaged consumers, build flags, watch rebuilds, and example environment checks pass.
• Tested packed 3.0.1 and the example's published 2.1.0 separately.
• The example requires Node ^20.19.0 || >=22.12.0 and targets Chrome/Edge 111+, Firefox 114+, and Safari 16.4+. Its lockfile updates React Select 5.3.0 to 5.10.2 and related UI dependencies.
• Watch cleans dist only at startup and ignores dependency manifest edits. PUBLIC_URL supports absolute paths/URLs and ././, but not ./folder or ../folder.
• ESLint 9 is unsupported. Version 10 needs React, accessibility, and import plugin support.

[guardrails]

All previously detected findings have been fixed. Good job! 👍🎉

We will keep this comment up-to-date as you go along and notify you of any security issues that we identify.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[KARSE22]

This calls esbuild directly so we can upgrade it without an override. The script handles cleanup, CLI options, and watch mode. Generated JavaScript matches main apart from trailing newlines; source maps reflect comment edits.

[KARSE22]

Vite still uses REACT_APP_LOB_API_KEY. React deduplication prevents npm link from loading a second React copy.

[KARSE22]

The added lint plugins previously came through eslint-config-react-app. We now declare them directly. globals supplies browser and Node globals; the Prettier plugin was already listed.

[KARSE22]

This replaces the old CRA/.eslintrc setup and keeps linting in one place for the library, example, tooling, and tests.

We use the recommended JS, React, hooks, and accessibility presets. projectRules adds our checks and exceptions. That long list of browser globals catches accidental references to names like event and name.

The remaining blocks apply the example's rules, keep Prettier outside example/, and limit Jest/Testing Library checks to tests and setup files. We skip dependencies, build output, snapshots, minified files, and dotfiles.

I also intentionally removed deprecated rules and expanded test linting.