Combine client dependency updates and eliminate all dependency vulnerabilities

[bensofficial]

Summary

Consolidates every open bot dependency PR into a single PR and drives both the client and documentation pnpm audit to 0 known vulnerabilities.

Server dependency updates, webpack-dev-server 6, and the docs dependency bumps already landed on develop separately (#1209, #1211, #1227), so this PR covers the remaining client npm updates, the transitive-dependency security fixes, and the Mailpit dev image.

Client dependency bumps

Package	From	To	Supersedes
@tiptap/* (all 10 packages, kept aligned)	3.29.0	3.29.2	#1226
@playwright/test	1.61.1	1.62.1	#1225
@eslint-react/eslint-plugin	5.18.0	5.18.1	#1224
webpack	5.108.4	5.109.2	#1208
webpack-bundle-analyzer	5.3.0	5.3.1	#1223
html-webpack-plugin	5.6.7	5.6.8	#1221
postcss	8.5.18	8.5.23	#1203, #1229
flatted (override)	3.4.2	3.4.4	#1220

Security fixes → 0 vulnerable dependencies

Client (client/pnpm-workspace.yaml overrides):

• brace-expansion 5.0.8 → 5.0.9 — GHSA-rgw5-rvv9-x895 (ReDoS)
• undici override <7.28.0 → <7.29.0: 7.29.0 — GHSA-4cwx-7wf7-3272 (+4 moderate)
• add svgo 4.0.2 — GHSA-2p49-hgcm-8545
• add fast-uri 3.1.5 — GHSA-7p8r-x3mc-p8w7 / GHSA-v2hh-gcrm-f6hx
• add transitive postcss 8.5.23 (pulled by vitest > vite) — GHSA-fxqj-rqcc-2cmp

Documentation (documentation/pnpm-workspace.yaml overrides):

• serialize-javascript 7.0.5 — GHSA-qj8w-gfj5-8c6v (RCE) + CPU-exhaustion advisory
• fast-uri 3.1.5 — GHSA-7p8r-x3mc-p8w7 / GHSA-v2hh-gcrm-f6hx
• uuid 11.1.1 — v3/v5/v6 buffer-bounds advisory (major bump; Docusaurus build verified below)

Dev tooling (supersedes #1207)

• axllent/mailpit docker tag v1.30.3 → v1.30.6 (both docker-compose.yml and docker-compose.showcase.yml)

Verification

• pnpm audit — 0 vulnerabilities in client/ and 0 in documentation/
• Client: tsc --noEmit clean, eslint src/ 0 errors, pnpm build (webpack 5.109.2) succeeds, 86/86 vitest unit tests pass
• Docs: pnpm build (Docusaurus) succeeds with the uuid 11 / serialize-javascript / fast-uri overrides

PRs made stale by this one

#1203, #1207, #1208, #1220, #1221, #1223, #1224, #1225, #1226, #1229, #1230

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated application and development tooling packages to newer versions.
  • Updated the Mailpit service used in local and showcase environments.
  • Added security-focused dependency version overrides and enabled required build scripts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0485136a-f638-413d-a4d0-f51a09d3a2b3

📥 Commits

Reviewing files that changed from the base of the PR and between 54b448d and 35a0b90.

⛔ Files ignored due to path filters (2)

• client/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• documentation/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (5)

• client/package.json
• client/pnpm-workspace.yaml
• docker-compose.showcase.yml
• docker-compose.yml
• documentation/pnpm-workspace.yaml

---

Walkthrough

The pull request upgrades client tooling and Tiptap packages, adds workspace dependency overrides, enables the core-js build script, and updates Mailpit images in both Docker Compose configurations.

Changes

Dependency maintenance

Layer / File(s)	Summary
Client package upgrades client/package.json	Tiptap, ESLint, Playwright, HTML Webpack, PostCSS, Webpack, and Webpack Bundle Analyzer versions were updated.
Workspace dependency overrides client/pnpm-workspace.yaml, documentation/pnpm-workspace.yaml	Dependency pins and advisory coverage were updated. The documentation workspace enables core-js build scripts and pins patched versions of serialize-javascript, fast-uri, and uuid.

Mailpit image refresh

Layer / File(s)	Summary
Mailpit image tags docker-compose.yml, docker-compose.showcase.yml	Both Mailpit services now use axllent/mailpit:v1.30.6.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ls1intum/thesis-management#1029: Updates overlapping client dependency and workspace configuration areas.
• ls1intum/thesis-management#1101: Updates client dependencies, workspace overrides, and Mailpit image versions.
• ls1intum/thesis-management#1120: Updates overlapping dependency overrides and Tiptap packages.

Suggested reviewers: krusche

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency updates and security remediation that form the main focus of the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/combined-client-deps-and-security

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Claudia-Anthropica]

@bensofficial The dependency manifests, workspace overrides, and generated lockfiles are internally consistent, and the Mailpit image was updated consistently in both Compose configurations. The documentation build and JavaScript/TypeScript CodeQL check succeeded in the captured CI snapshot, and I found no blocking defects.