home-tracker B: dependency & framework freshness pass

B worker (Claude, Solo proc 1110) COMPLETE — branch flower/brief-213-dependency-pass, 2 commits, NOT yet merged (held for operator merge decision). MAIN never touched. RESULT: safe in-range (caret) bumps across composer + npm — flux/flux-pro 2.1.6→2.15.0, laravel/framework 12.17→12.62, volt 1.7.1→1.10.5, pint 1.22→1.29, sail/pail/tinker/collision + transitive; npm axios 1.7.9→1.18.1, vite 6.2→6.4, tailwind 4.0.8→4.3.2, etc. SECURITY (both audits now clean): composer audit 14 advisories → 0 (incl. livewire/livewire 3.6.3→3.8.2 fixing CVE-2025-54068 RCE); npm audit 9 → 0, no --force. MAJOR HELD: flux 2.15 would transitively pull livewire/livewire 3→4; held per brief via explicit `livewire/livewire:^3.7.4` pin (the ONLY composer.json change) → resolved 3.8.2 (latest 3.x, still fixes CVE). Livewire 4 deferred. TESTS: `php artisan test` 97 pass / 2 fail. The 2 fails are pre-existing GamingNetworkHealthTest drift (from commits 3aa2390 emptying eft=>[] and 9eaafd1 slug changes, both after the test was written) — NOT caused by the bumps; worker verified the sibling "degraded" test passes on the same seed stack. Left untouched (out of scope). Pint: 40 pre-existing flags, none from this pass; plain pint intentionally not run. DEFERRED MAJORS (need a follow-up brief + manifest edits): laravel/framework 12→13, livewire 3→4, laravel/tinker 2→3, pestphp/pest 3→4 (as a set with plugins), vite 6→8, concurrently 9→10, laravel-vite-plugin 1→3. MERGE STATUS: branch clean & ready. Blocker: merge protocol's "migrate → full suite → verify on real MySQL" cannot run while MAIN can't authenticate to Proxmox MySQL (brief #212 blocker). Recommend resolving #212 first, then merge #213 + verify in one pass.

## Dependency & framework freshness pass — complete Worked in worktree `home-tracker-brief-213` on branch `flower/brief-213-dependency-pass` (2 commits, NOT merged — left for orchestrator). ### Approach All manifest constraints are caret (`^`) ranges that lock the major, so `composer update` / `npm update` respecting them applies exactly the safe patch/minor bumps and cannot cross a major. Majors require a manifest edit → naturally held. ### Safe bumps applied - **Composer** (direct): laravel/framework 12.17.0→12.62.0, livewire/flux + flux-pro **2.1.6→2.15.0** ✅, livewire/volt 1.7.1→1.10.5, laravel/pint 1.22.1→1.29.3, laravel/sail 1.43.1→1.63.0, laravel/pail 1.2.2→1.2.7, laravel/tinker 2.10.1→2.11.1, nunomaduro/collision 8.8.0→8.9.4. Plus transitive security bumps (guzzle, symfony, league/commonmark, psysh, phpunit…). - **npm**: axios 1.7.9→1.18.1, vite 6.2.0→6.4.3, tailwindcss + @tailwindcss/vite 4.0.8→4.3.2, autoprefixer 10.4.20→10.5.2, concurrently 9.1.2→9.2.3, laravel-vite-plugin 1.2.0→1.3.0. ### Security - **composer audit: 14 advisories → 0.** Notably livewire/livewire 3.6.3→**3.8.2** fixes CVE-2025-54068 (RCE, affected <3.6.4); symfony mail/mime/routing/yaml, guzzle, commonmark CVEs all resolved in-range. - **npm audit: 9 vulns (2 critical / 5 high / 2 moderate) → 0** (all fixed by in-range updates; no `--force` needed). ### One notable catch — held a transitive major Bumping flux to 2.15.0 initially pulled **livewire/livewire 3.6.3 → 4.3.3** transitively (flux 2.15 allows `^3.7.4|^4.0`). Livewire is this app's core frontend framework, so per the brief I held it: added explicit `livewire/livewire: ^3.7.4` to composer.json, re-resolved to **3.8.2** (latest 3.x, satisfies flux/volt, fixes the CVE). Livewire 4 deferred. ### Deferred majors (need operator review + manifest edits) - **laravel/framework 12→13** — full framework major; app targets ^12. - **livewire/livewire 3→4** — core UI framework major; held via pin above. - **laravel/tinker 2→3** — dev REPL major. - **pestphp/pest 3→4** + pest-plugin-laravel 3→4 + pest-plugin-drift 3→4 — test framework major (upgrade as a set). - **vite 6→8** — build tool major (2 majors). - **concurrently 9→10**, **laravel-vite-plugin 1→3** — dev tooling majors. ### Tests & Pint - `php artisan test`: **97 passed, 2 failed**. The 2 failures (`GamingNetworkHealthTest`: "reports normal…", "reports critical…") are **pre-existing test drift, NOT caused by the bumps**. Root cause: commit 3aa2390 emptied the service's `'eft' => []` slug list and 9eaafd1 changed slugs, both *after* the test was last written (f71b08a); `evaluateEft()` now always returns `'unknown'`, so `evaluateOverall()` can never be "ALL CLEAR" while the test still seeds `eft-chicago-1`. The "degraded" test on the same seed stack passes, proving the framework/DB/Carbon machinery is fine post-bump. Left untouched — fixing the gaming-health test belongs to that feature's owner. (Note: a fresh checkout also needs `npm run build` before HTTP tests pass — that produced 10 additional transient failures I resolved by building assets; the toolchain builds green.) - `./vendor/bin/pint --test`: reports 40 files with style issues — **all pre-existing, none touched by this pass** (bootstrap, models, console commands, tests, routes, config). Did NOT run plain `pint` to avoid a 40-file reformat unrelated to deps on this branch. (Some may be newly-enforced by the pint 1.22→1.29 bump.) Deps reviewed ✅ · safe bumps applied ✅ · both audits clean ✅ · deferred majors listed w/ rationale ✅.

# B — Dependency & framework freshness pass Child of epic #211. Low risk; stack already modern (Laravel ^12, Livewire+Volt, Flux/Flux-Pro 2.1.6, Tailwind v4, Vite 6) — cleanup, not the blocker the original note implied. ## Do - `composer outdated --direct` and `composer audit`. - `npm outdated` and `npm audit`. - Confirm `livewire/flux` + `livewire/flux-pro` on latest 2.x (currently 2.1.6). - Apply safe patch/minor bumps; hold any major bumps for operator review with notes. - Run `php artisan test` and `./vendor/bin/pint` after bumps; report results. ## Done when Deps reviewed, safe bumps applied, tests green, deferred majors listed with rationale.

# B — Dependency & framework freshness pass Child of epic #211. Low risk; the stack is already modern (Laravel ^12, Livewire+Volt, Flux/Flux-Pro 2.1.6, Tailwind v4, Vite 6), so this is cleanup, not the blocker the original note implied. ## Do - `composer outdated --direct` and `composer audit`. - `npm outdated` and `npm audit`. - Confirm `livewire/flux` + `livewire/flux-pro` on latest 2.x (currently 2.1.6). - Apply safe patch/minor bumps; hold any major bumps for operator review with notes. - Run `php artisan test` and `./vendor/bin/pint` after bumps; report results. ## Done when Deps reviewed, safe bumps applied, tests green, and any deferred majors listed with rationale.