chore(deps): aggiorna toolchain frontend

[max23468]

Riepilogo\n- aggiorna dipendenze Vercel, XML, Vite/Vitest e tool frontend\n- mantiene TypeScript 6.0.3 perché il builder Vercel non supporta ancora TypeScript 7\n- porta React Doctor a 0.9.12 e aggiorna l’Action\n- elimina la versione vulnerabile transitiva di nanoid\n\n## Verifiche\n-

Agent guidance

• Treat React Doctor diagnostics as starting hypotheses. Read the relevant code before confirming or suppressing each finding.
• For each group, decide true positive, false positive, or needs-human-review, then assign high/medium/low confidence.
• Do not suppress a finding without evidence from the file in question. Confidence requires code context.
• Understand the root cause before editing. Fix the underlying code instead of changing react-doctor config or suppressing rules unless explicitly asked.
• Investigate deeply where relevant: race conditions, security-sensitive flows, state propagation, multi-file refactors, and downstream dependency chains.
• Ignore pure style preferences, theoretical issues without real impact, missing features, and unrelated pre-existing code.
• Start with high-confidence fixes that preserve behavior. Leave low-confidence or product-dependent changes as notes.
• Run npx react-doctor@latest --verbose --scope changed before and after changes, plus relevant tests after each focused batch.
• When available, spawn subagents or isolated worktrees for independent rule families, then review and merge only the best safe fixes.
• Split unrelated, broad, or behavior-changing work into separate PRs/branches instead of one large cleanup.
• When one rule spans dozens of files (a migration-scale change), fix a representative sample first, confirm the recipe holds, and get the code owner's sign-off before changing the rest. Don't mass-fix a broad pattern in one unreviewed pass.
• For confirmed issues that cannot be fixed now, create GitHub issues with the rule, file/line, confidence, impact, and proposed fix.
• If a fix needs an API, UX, or architecture decision, stop and ask before editing.

✔ Scanned 47 files in 2.0s

React Doctor — sentinel
Score: 100 / 100 Great

✔ No issues found!

────────────────────────────────────────────────────────────

Share: https://react.doctor/share?p=sentinel&s=100
Tell others how you did on socials

Docs: https://react.doctor/docs
Learn more about fixing issues, setting up CI/CD, and
configuring rules with a config file

GitHub: https://github.com/millionco/react-doctor
Report issues and star the repository!

vite v8.2.2 building client environment for production...
transforming...
✓ 16 modules transformed.
rendering chunks...
computing gzip size...
dist-web/index.html 0.49 kB │ gzip: 0.30 kB
dist-web/assets/index-_ZpP-oKm.css 6.70 kB │ gzip: 2.07 kB
dist-web/assets/index-BdtIOCwX.js 199.52 kB │ gzip: 62.39 kB

✓ built in 98ms

RUN v4.1.11 /Users/Matteo/Documents/Codex/2026-08-26/fa/work/repo-updates/Sentinel

Test Files 15 passed (15)
Tests 72 passed (72)
Start at 14:13:55
Duration 1.15s (transform 1.04s, setup 0ms, import 3.35s, tests 403ms, environment 1ms)

✔ legge la priorità solo dall'intestazione del finding (1.251208ms)
✔ blocca soltanto P0/P1 dell'HEAD corrente (0.373458ms)
✔ P2/P3 sono advisory e completano il gate dopo l'assestamento (0.172916ms)
✔ un advisory top-level richiede il marker dell'HEAD (0.458542ms)
✔ il pollice della PR vale solo per il primo giro automatico (0.10625ms)
✔ i giri successivi usano la reaction dell'invocazione corrente (0.146709ms)
✔ seleziona solo un'invocazione esatta, fidata e successiva all'HEAD (0.179167ms)
✔ il primo giro è automatico solo su apertura o ready (0.08575ms)
✔ gli errori operativi bloccano in assenza di una review conclusa più recente (0.118875ms)
✔ valida il numero PR e mantiene il polling entro cinque ore (0.329666ms)
✔ il workflow usa codice trusted e non richiede commenti al primo giro (7.801167ms)
ℹ tests 11
ℹ suites 0
ℹ pass 11
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 78.019459 (72 test)\n- React Doctor: 100/100\n- npm audit e OSV Scanner: puliti\n\nNessun deploy eseguito.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c0e613ac80

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Mantieni TypeScript 6 finché Vercel supporta la 7

Al prossimo deploy della dashboard, Vercel deve compilare le Functions in api/ tramite @vercel/node: il repository documenta già in .github/dependabot.yml (righe 27-30) che il builder carica l'API JavaScript rimossa da TypeScript 7.0 e quindi va in crash fino alla 7.1. I test e vite build riportati nel commit non esercitano questo builder remoto; lasciare ^7.0.2 rende quindi impossibile pubblicare nuovi deploy della dashboard. Ripristina TypeScript 6 oppure aggiorna solo a una versione per cui sia stata verificata la compatibilità del builder Vercel.

AGENTS.md reference: AGENTS.md:L13-L15

Useful? React with 👍 / 👎.

[max23468]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 1307f6d562

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".