chore: secure frontend build toolchain

2026-07-14 11:49:12 +02:00
parent d7eadbc6ca
commit 68ee228f1b
6 changed files with 315 additions and 157 deletions
@@ -17,6 +17,7 @@
 - Live Tower/PostGIS validation on the persisted Mol-center run evaluated 304 of 374 GRB references, excluded 70 outside the inference tile, persisted six canonical Metric rows and exposed 14 possible box-to-footprint artifacts without inflating the strict scores.
 - Updated the API contract audit to use the canonical OpenAPI path map after FastAPI 0.139 introduced grouped top-level routers; this keeps all 81 operations audited across clean framework installations.
 - Kept Starlette on its supported pre-1.0 compatibility line until GeoIntel deliberately migrates its test client from `httpx` to `httpx2`; this removes the new framework deprecation warning without taking an unrelated test-stack upgrade.
+- Upgraded the build-only frontend toolchain to Vite 7.3.6 and React plugin 5.2, declared the Node 20.19+/22.12+ engine contract and reduced `npm audit` from one high plus one moderate finding to zero without changing React, MapLibre or runtime behavior.

 ## Sprint 183 Mol map source clarity and live AI validation (2026-07-14)