chore(frontend): move to Node 22 and React Router 8

React Router 7.12.0 through 8.2.x carry a high-severity RSC-mode CSRF bypass
(GHSA-qwww-vcr4-c8h2). We were on 7.18.1, inside that range. The advisory is not
reachable here — the app is a client-side SPA on createBrowserRouter with no
@react-router/server and no RSC entry point, and the frontend ships as static
Vite output — but 7.18.1 is the final 7.x release, no backport exists, and 8.3.0
is the only patched version, so staying put means staying on an EOL line with a
permanent open alert.

react-router-dom has no 8.x at all; the DOM exports moved into react-router
itself. So the dependency is swapped and every import rewritten. All ten APIs in
use here are unchanged in 8.3.0, and none of the data-layer surface that changed
most between majors is used.

react-router 8 requires Node >=22.22.0, which is the same wall that had jsdom 30
and @testing-library/jest-dom 7 sitting in the Dependabot ignore list. Node 20
reached EOL on 2026-04-30, so the toolchain moves to Node 22 across CI, the wiki
workflow, the Dockerfile and docker-compose. That unblocks all three at once:
jsdom and jest-dom are taken here too, and their ignores are removed rather than
left carrying a rationale that no longer holds.

Verified on the frontend suite: tsc -b and vite build clean, 310 tests across 35
files pass before and after the jsdom/jest-dom bumps.

.github/dependabot.yml

@@ -83,19 +83,17 @@ updates:
         applies-to: version-updates
         update-types: ["minor", "patch"]
     ignore:
-      # Both majors are blocked on infrastructure migrations we have not done,
-      # so they can only sit red. Same rationale as the pandas pin above:
-      # revisit each as a dedicated migration, not a dependency bump.
-      #   @vitejs/plugin-react 6.x peers vite@^8 (we are on vite 6.x).
-      #   @testing-library/jest-dom 7.x requires Node >=22 (CI/Docker use 20).
-      #   jsdom 30.x requires Node ^22.22.2 || ^24.15.0 || >=26 (same wall);
-      #     on Node 20 it surfaces as vitest failing to start its pool workers.
+      # @vitejs/plugin-react 6.x peers vite@^8 and we are on vite 6.x, so it can
+      # only sit red. Same rationale as the pandas pin above: revisit as a
+      # dedicated migration, not a dependency bump.
+      #
+      # The jsdom and @testing-library/jest-dom majors used to be ignored here
+      # too, both blocked on Node >=22 while CI and Docker ran Node 20. That
+      # wall is gone — Node 20 reached EOL on 2026-04-30 and the toolchain moved
+      # to Node 22 — so both were taken and the ignores removed rather than left
+      # with a rationale that no longer holds.
       - dependency-name: "@vitejs/plugin-react"
         update-types: ["version-update:semver-major"]
-      - dependency-name: "@testing-library/jest-dom"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "jsdom"
-        update-types: ["version-update:semver-major"]
 
   # GitHub Actions workflow pins.
   - package-ecosystem: "github-actions"

.github/workflows/test.yml

@@ -54,7 +54,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 

.github/workflows/wiki.yml

@@ -22,7 +22,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "20"
+          node-version: "22"
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with: