[pierpman]

Description

Fixes yarn audit findings by upgrading direct dependencies and adding targeted resolutions for transitive packages.
No production source code was changed.

Direct dependency bumps (within same major unless noted):

• react-router-dom 7.15.1 → 7.18.2
• vite ^6.3.5 → ^6.4.4
• commitizen ^4.3.1 → ^4.3.2
• vitest + @vitest/coverage-v8 ^3.x → ^4.1.11 (major bump, dev tooling only)
• cypress ^14.x → ^15.21.1 (major bump, dev tooling only)

package.json resolutions added:

• **/@babel/core: 7.29.6 — pins to latest patched 7.x
• **/vitest/vite: 6.4.4 — prevents Yarn v1 from resolving vite 8 for Vitest 4's ^6||^7||^8 peer range
• **/wait-on/axios: 1.20.0 — keeps wait-on on the patched axios

Cypress 15 migration (cypress/support/commands.ts, cypress.config.ts):

• Replaced deprecated Cypress.env() calls with cy.env(['KEY1','KEY2']).then(…)
• Set allowCypressEnv: false to opt into strict mode and silence the startup warning

Vitest 4 migration (vite.config.ts):

• Removed all: false and include from the coverage block (options removed in Vitest 4)
• Expanded exclude to cover mocks/** and non-JS asset files

Note on remaining findings: braces (via micromatch) has no patched release and cannot be fixed.

Additional context (optional)

• yarn audit reduced from 153 findings to 2 (both braces, unfixable).
• All major bumps are dev tooling only — nothing in the app bundle changed.
• Vitest 4 uses AST-based V8 remapping; statement coverage drops ~98% → ~95% due to inline callbacks being reported differently. No tested code was lost.
• ws is not overridden globally — chrome-remote-interface (new in Cypress 15) uses ws 7.5.13 and jsdom uses ws 8.21.0 as separate lock entries, both patched.

How to test

yarn install --frozen-lockfile
yarn audit          # expect 2 findings (braces only)
npx tsc --noEmit    # expect no errors
yarn lint           # expect 0 errors
yarn test           # expect 78 test files, 319 tests passing
yarn build          # expect webpack build to complete with 0 errors
yarn start          # expect the application to work as expected with mock data

OBSERVER_URL=<network observer console url route> yarn start # expect the application to work as expected with real data

[JPadovano1483]

lgtm