fix: resolve npm audit vulnerabilities in express and vite

[Copilot]

npm audit flagged 5 vulnerabilities across backend and frontend.

Backend — express 5.0.0 → 5.2.1

• qs ≤6.14.1 (moderate): arrayLimit bypass enables DoS via memory exhaustion
• cookie <0.7.0 (low): accepts name/path/domain with out-of-bounds characters

Both are transitive through express. Bumping to 5.2.1 (semver-minor, non-breaking) resolves both.

Frontend — vite ^5.4.8 → ^6.4.2

• esbuild ≤0.24.2 (moderate): dev server allows cross-origin request forgery

All Vite 5.x versions pin vulnerable esbuild; Vite 6.x is required. @vitejs/plugin-react updated to 5.2.0 (supports Vite 4–8) and moved from dependencies to devDependencies where it belongs.

Verification

• npm audit: 0 vulnerabilities in both packages
• Backend: 13 suites, 140 tests passing
• Frontend: production build succeeds with Vite 6

[OlympusLedgerOrg]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved in 8d80944. Conflicts were in frontend/package.json and frontend/package-lock.json — main added html5-qrcode and several other deps (react-router-dom, recharts, vite-plugin-pwa, workbox). Merged keeping @vitejs/plugin-react in devDependencies only (per this PR) and accepting all new deps from main. Frontend build and backend tests (178 passing) verified post-merge.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• checkpoint.prisma.io
  • Triggering command: /opt/hostedtoolcache/node/24.14.1/x64/bin/node /opt/hostedtoolcache/node/24.14.1/x64/bin/node /home/REDACTED/work/TiM/TiM/backend/node_modules/prisma/build/child {"product":"prisma","version":"6.19.3","cli_install_type":"local","information":"","local_timestamp":"2026-04-16T21:03:15Z","project_hash":"9cb7fcbb","cli_path":"/home/REDACTED/work/TiM/TiM/backend/node_modules/.bin/prisma","cli_path_hash":"59e0e217","endpo (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)