[thedamian]

Summary

Upgrades server and client dependencies to resolve 23 of the 24 open Dependabot alerts. All bumps stay within current major versions.

Server

Change	Alerts
morgan 1.11.0 → 1.12.1 (runtime)	#74, #82
concurrently 10.0.3 → 10.0.6 (brings shell-quote 1.12.0)	#52, #92
jest 30.4.2 → 30.5.2 + overrides: { minimatch: 11.0.3 }	#122

The minimatch override is needed because no current nodemon/jest release allows minimatch 11 yet.

Client

Change	Alerts
@tanstack/react-router 1.170.46, @tanstack/router-plugin 1.168.48 (brings seroval 1.7.6, runtime)	#109, #110, #112, #113, #114, #115
vite 8.1.3 → 8.3.5, vitest 4.1.10 → 4.1.12	#73, #77, #97, #99, #101, #103, #105, #106
Lock refresh: browserslist 4.29.5, baseline-browser-mapping 2.11.34, source-map-js 1.2.2	#71, #79, #93

client/src/routeTree.gen.ts was regenerated by the newer router plugin (route ordering only).

Not fixed

• Dev #120 deepmerge (low): no patched release exists. It's only pulled in by jest (test tooling).
• npm audit also reports a new glob advisory via jest's dependencies; the fix requires glob 14, which those packages don't support yet. Test-time only.

Testing

• Server: jest suite passes (with and without coverage); server started under nodemon, serves requests, morgan logs, nodemon restarts on file change.
• Client: tsc + vite build succeed, vitest 32/32 pass, oxlint clean, Vite dev server serves pages, npm audit reports 0 vulnerabilities.
• Verified locally on Windows / Node 24; CI covers Ubuntu / Node 26.

🤖 Generated with Claude Code