fix dependency security issues

.github/workflows/ci.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 

frontend/Dockerfile

@@ -3,7 +3,7 @@
 # RagIndex frontend — built with Vite, then served as static files by nginx,
 # which also reverse-proxies "/api/..." to the backend service.
 #
-FROM node:20-alpine AS build
+FROM node:22-alpine AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci

frontend/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "description": "RagIndex landing page — dark hero with looping video, marquee and liquid-glass UI.",
   "engines": {
-    "node": ">=18"
+    "node": ">=22.22.0"
   },
   "scripts": {
     "dev": "vite",
@@ -21,20 +21,20 @@
     "clsx": "^2.1.1",
     "lucide-react": "^0.408.0",
     "ogl": "^1.0.11",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "react-markdown": "^9.1.0",
-    "react-router-dom": "^7.0.0",
+    "react-router": "^8.3.0",
     "remark-gfm": "^4.0.1",
     "tailwind-merge": "^2.5.2"
   },
   "devDependencies": {
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
-    "@types/node": "^20.14.10",
-    "@types/react": "^18.3.3",
-    "@types/react-dom": "^18.3.0",
+    "@types/node": "^22.20.1",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "@vitejs/plugin-react": "^4.3.4",
     "autoprefixer": "^10.4.19",
     "jsdom": "^29.1.1",
@@ -44,4 +44,4 @@
     "vite": "^6.4.3",
     "vitest": "^3.2.6"
   }
-}
+}

frontend/src/App.tsx

@@ -1,5 +1,5 @@
 import { lazy, Suspense } from "react";
-import { BrowserRouter, Routes, Route } from "react-router-dom";
+import { BrowserRouter, Routes, Route } from "react-router";
 
 // Code-split each route. A visitor landing on "/" should not have to download
 // the WebGL bundle (ogl, used only on /upload) or the markdown renderer

frontend/src/components/Hero.tsx

@@ -1,4 +1,4 @@
-import { Link } from "react-router-dom";
+import { Link } from "react-router";
 
 import StarBorder from "@/components/ui/StarBorder";
 

frontend/src/pages/Chat.tsx

@@ -1,5 +1,5 @@
 import { memo, useCallback, useEffect, useRef, useState } from "react";
-import { Link, useLocation, useNavigate } from "react-router-dom";
+import { Link, useLocation, useNavigate } from "react-router";
 import {
   ArrowUp,
   ArrowRight,

frontend/src/pages/Index.tsx

@@ -1,4 +1,4 @@
-import { Link } from "react-router-dom";
+import { Link } from "react-router";
 import {
   ChevronDown,
   ArrowRight,

frontend/src/pages/Upload.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useRef, useState } from "react";
-import { Link, useNavigate } from "react-router-dom";
+import { Link, useNavigate } from "react-router";
 import { FolderUp, FileUp, ArrowRight, Check, Lock, X } from "lucide-react";
 
 import { Button } from "@/components/ui/button";

frontend/vite.config.ts

@@ -52,7 +52,7 @@ export default defineConfig(({ mode }) => {
           // download the WebGL (ogl) or markdown code — those load on demand with
           // the /upload and /chat routes.
           manualChunks: {
-            "vendor-react": ["react", "react-dom", "react-router-dom"],
+            "vendor-react": ["react", "react-dom", "react-router"],
             "vendor-webgl": ["ogl"],
             "vendor-markdown": ["react-markdown", "remark-gfm"],
           },