chore(deps): update npm dependencies and gate breaking dependabot majors

[rlorenzo]

Applies the npm dependency updates from the open Dependabot PRs, minus one package that breaks the install, and adds config so the broken ones stop being proposed.

Supersedes #287, #284, and #288. #289 (Actions) and #290 (NuGet) are unaffected.

Updated

• npm-root group (full): fallow 3.10.0, jscpd 5.0.14, oxfmt 0.61.0, oxlint 1.76.0
• npm-vueapp group (except TypeScript): @vueuse/core 14.4.0, quasar 2.23.3, globals 17.8.0, npm-run-all2 9.0.3
• postcss 8.5.25, which is also a moderate advisory fix (GHSA-fxqj-rqcc-2cmp)
• In-range bumps picked up along the way: chart.js, lodash-es, @eslint/js, cross-env, postcss-html

TypeScript held at ^6.0.3

TS 7 is the native compiler rewrite and falls outside @typescript-eslint 8.x's peer range of <6.1.0. #288 fails npm ci with ERESOLVE in 7 seconds:

npm error Could not resolve dependency:
npm error peer typescript@">=4.8.4 <6.1.0" from @typescript-eslint/eslint-plugin@8.65.0
npm error Conflicting peer dependency: typescript@6.0.3

typescript-eslint has no release declaring TS 7 support yet, so this is not something we can resolve on our side.

Two security repins

npm update silently downgraded brace-expansion and fast-uri to vulnerable versions, reverting fca7a47, because .npmrc min-release-age=7 still gates both advisory fixes (5.0.9 at 6.5 days old, 3.1.5 at 5.5 days). Restored to the fixed versions.

Worth knowing: anyone running a plain npm update in the next few days will hit the same trap and reintroduce both advisories.

Dependabot ignores

Added semver-major ignores for TypeScript (npm, /VueApp) and NSubstitute (NuGet). Both are limited to majors, so patches and minors still flow, and each carries its removal condition in a comment. NSubstitute 6.0.0 reverts the deliberate 5.3.0 pin in Viper.test.csproj, whose comment says to unpin once 6.0.1 ships; 6.0.1 has not shipped.

Verification

• vue-tsc --build clean
• 1121 frontend tests across 88 files passing
• npm audit clean in both trees (root and VueApp)
• oxfmt 0.61 and oxlint 1.76 confirmed churn-free by running old against new: identical 7 flagged files, identical 2220-finding sets with zero added and zero removed
• Full pre-commit gate (lint, tests, build verify) passed on both commits

[codecov-commenter]

Bundle Report

Changes will increase total bundle size by 826 bytes (0.04%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
viper-frontend-esm	2.29MB	826 bytes (0.04%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: viper-frontend-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
assets/GenericError-*.js	447 bytes	531.53kB	0.08%
assets/dist-*.js	20 bytes	11.57kB	0.17%
assets/dist-*.js	359 bytes	3.35kB	11.99% ⚠️

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.11%. Comparing base (749617c) to head (8efa522).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #291   +/-   ##
=======================================
  Coverage   50.11%   50.11%           
=======================================
  Files        1000     1000           
  Lines       58432    58432           
  Branches     5867     5867           
=======================================
  Hits        29286    29286           
  Misses      28237    28237           
  Partials      909      909           

Flag	Coverage Δ
backend	49.26% <ø> (ø)
frontend	58.63% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

Updates the repository’s npm dependency sets (root tooling + VueApp) and adjusts Dependabot configuration to avoid opening grouped PRs that are known to break installs/tests (TypeScript major in VueApp; NSubstitute major in NuGet).

Changes:

• Bumped selected root devDependencies (lint/format/tooling) and refreshed package-lock.json.
• Bumped selected VueApp dependencies/devDependencies (Quasar/VueUse/Chart.js + tooling) and refreshed VueApp/package-lock.json.
• Added Dependabot semver-major ignores for NSubstitute (NuGet) and TypeScript (VueApp) with documented removal conditions.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
VueApp/package.json	Updates VueApp runtime/dev dependencies while keeping TypeScript pinned to ^6.0.3.
VueApp/package-lock.json	Lockfile refresh reflecting the VueApp dependency bumps and repins.
package.json	Updates root dev tooling versions (fallow/jscpd/oxfmt/oxlint/etc.).
package-lock.json	Lockfile refresh reflecting the root tooling bumps and repins.
.github/dependabot.yml	Adds semver-major ignore rules to prevent known-breaking grouped Dependabot PRs.

Files not reviewed (1)

• VueApp/package-lock.json: Generated file

[rlorenzo]

Merging in since it's very similar to the recent plugin updates. Just minor bumps