build(deps): migrate toolchain to vite 8, vitest 5, TS 6, eslint 10; CI to Node 24

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
           cache-dependency-path: app/package-lock.json
 
@@ -117,8 +117,17 @@ jobs:
           # ID is banned outright — it collects nothing, so any reintroduction
           # is always a bug. Everything else stays banned as before.
           remnant_re='segment|linkedin|carbonads|chikita|flatfile|typekit|putObject|UA-46942708'
+          # Intl.Segmenter is the browser grapheme-segmentation API referenced
+          # by CodeMirror's text-edit commands (@codemirror/state). The vite 5
+          # / esbuild minifier dropped the side-effect-free reference; the
+          # vite 8 / rolldown compressor preserves member-access expressions,
+          # so the string survives into the bundle. Same strip-and-regrep
+          # discipline as the sanctioned banner URL below: a real Segment
+          # analytics integration (segment.io / analytics.js) still trips the
+          # scan.
           if grep -riE "$remnant_re" "${targets[@]}" \
-              | sed 's#github[.]com/FlatFilers/csvjson-app/discussions/163##g' \
+              | sed -e 's#github[.]com/FlatFilers/csvjson-app/discussions/163##g' \
+                    -e 's#Intl[.]Segmenter##g' \
               | grep -iE "$remnant_re"; then
             echo "::error::Promotional or telemetry remnant found in the shipped frontend or PHP shim (spec criterion 8)"
             exit 1

.obvious/obvious.md

@@ -4,7 +4,7 @@ Source for www.csvjson.com: a minimal React SPA for in-browser data conversion (
 
 ## Stack
 
-- **Frontend:** React 19 + Vite + TypeScript + Tailwind 4 (app/). CodeMirror for the editable JSON surface, lucide-react for icons, @tanstack/react-virtual for large tables. Dependencies are pinned; dependency behavior changes land as postinstall patches (`app/scripts/patch-*.mjs`), never as forkes.
+- **Frontend:** React 18 + Vite + TypeScript + Tailwind 4 (app/). React stays 18, not 19: @glideapps/glide-data-grid@6.0.3 — the app's table engine — peers react ≤18. CodeMirror for the editable JSON surface, lucide-react for icons, @tanstack/react-virtual for large tables. Dependencies are pinned; dependency behavior changes land as postinstall patches (`app/scripts/patch-*.mjs`), never as forkes.
 - **PHP shim:** plain PHP 8.4 files at the repo root — `index.php` (front controller: SPA serving, 301 redirect map, legacy permalink hydration, route registration), `feedback-db.php` / `feedback-api.php` / `feedback-admin.php`, `changelog-db.php` / `changelog-vote-api.php`. No framework, no composer.
 - **Database:** PostgreSQL via `DATABASE_URL` (Heroku/Neon `postgres://` URL parsed to a libpq DSN). Tables self-create on first use (`feedback_ensure_schema`, `changelog_ensure_schema`, `feedback_ensure_write_log`) — there are no migrations. Locally anything runs without a database; the write endpoints answer 503.
 - **Build artifacts:** `app/dist` is committed. CI hash-guards it against a fresh `npm run build` — always rebuild and commit `app/dist` when `app/` changes.