chore(deps-dev): bump @eslint/js from 9.39.5 to 10.0.1 in /web - #11

…#22)

* build(deps): React 19, Vite 8, Vitest 4, and the GitHub Actions majors

Closes the dependabot backlog in one sweep rather than 17 sequential
rebase-and-merge cycles: every one of those PRs touches package.json or
package-lock.json, so each merge conflicts the next and the queue can only
drain one CI round at a time.

── GitHub Actions (7 PRs) ────────────────────────────────────────────────────

checkout 4→7, setup-go 5→7, setup-node 4→7, setup-python 5→7, deploy-pages 4→5,
upload-pages-artifact 3→5, action-gh-release 2→3. Mechanical; the v4/v5 majors
were also emitting Node 20 deprecation warnings on every run.

── Web (7 of 10 PRs) ─────────────────────────────────────────────────────────

react + react-dom 18.3.1→19.2.8, @types/react 19, @dnd-kit/sortable 8→10
(with core →6.3.0 for its peer), vite 5→8, @vitejs/plugin-react 4→6,
vitest + @vitest/coverage-v8 2→4, globals 15→17, eslint-plugin-react-hooks 5→7,
typescript-eslint →8.68.0.

Three things had to change for these to work:

  • React 19 types. `useRef<T>(null)` now yields `RefObject<T | null>` rather
    than `RefObject<T>` — the honest type, since a ref genuinely is null until
    its element mounts. Fixed at the three declaration sites (useStickToBottom's
    return, Modal's initialFocusRef, HITLPopup's firstActionRef) rather than
    cast away at the ~10 use sites.

  • Vite 8 builds on rolldown, which accepts `manualChunks` only as a callback
    and fails the build outright on the object form. Same three vendor chunks
    (react / dnd / icons), matched on module id.

  • `__dirname` in the vite and vitest configs, which Vite 8's native config
    loader warns about. Now `import.meta.dirname`.

── The new React Compiler lint rules are OFF, deliberately ──────────────────

eslint-plugin-react-hooks v7 enables a family of rules derived from the React
Compiler. They flag 42 EXISTING patterns across Studio — not regressions, just
constructs the compiler cannot prove safe to memoize, setState-inside-an-effect
being most of them.

They are off rather than warnings because a warning nobody can act on 42 times
is noise that trains people to ignore the whole report. Adopting them is a real
refactor of state flow across the app and deserves its own review, not a
silent rewrite of every effect riding along in a version bump.

rules-of-hooks and exhaustive-deps — the two that caught real shipped bugs —
stay errors. The gate is not weakened by one rule: eslint still reports
0 errors and the same 50 pre-existing warnings it did before.

── Three PRs are NOT adoptable, and the blocker is upstream ─────────────────

  typescript 5.9.3 → 7.0.2 (#17)
    typescript-eslint caps TypeScript at <6.1.0 — including its own 8.68.1
    alphas. Taking TS 7 means deleting TypeScript linting from the project.

  eslint 9.39.5 → 10.8.1 (#19) and @eslint/js → 10.0.1 (#11)
    eslint-plugin-jsx-a11y's newest release (6.10.2) peers eslint ^3..^9 only.
    No ESLint 10 support has shipped.

Forcing either with --legacy-peer-deps produces a tree whose linting is
silently broken, which is worse than staying on the current major. They stay
open until the ecosystem catches up.

Verified: tsc clean, eslint 0 errors, 79/79 vitest, vite build green, Go build
+ lint at the zero baseline + full suite clean, and Studio exercised in a
browser under React 19 — SSE connected, all chunks and API calls 200, the
composition preview and phase rail rendering correctly.

* ci: run Node 22, which the new web toolchain requires

Vitest 4 pulls a jsdom whose undici calls `webidl.util.markAsUncloneable`,
added in Node 22.10. On CI's Node 20 that is a TypeError thrown while merely
IMPORTING jsdom, so every test file failed to start — 9 unhandled errors and
'no tests' rather than a test failure.

Two jobs disagreed about this and the disagreement hid it: Web Frontend Check
only runs tsc and the build, so it passed; Lint & Test and Pre-commit run
`make check`, which runs vitest, and both failed. A green check on the job
named after the frontend was reporting on half of it.

`engines: node >=22.10` in web/package.json makes the floor explicit, so a
mismatch fails at install time with a readable message instead of at test time
with a TypeError from inside a transitive dependency. Docs updated from the
stale 'Node 18+' to match.