chore(deps): drop unused deps and apply safe security updates

[tonyco97]

Summary

Goal: reduce the Renovate PRs opened every Monday on packages we don't use, clear the security alerts that can be fixed without major upgrades, and remove dead code. Same approach as nethesis/nethvoice-cti#591 and nethesis/phone-island#293. No behavior change intended.

Everything removed has zero references on main (imports, require(), configs, scripts, workflows, IPC channel strings, asset file names).

Removed dependencies (no import, config or runtime usage)

• crypto-browserify, i18next-http-backend, i18next-browser-languagedetector (i18n uses a custom detector), vite-plugin-copy, auto-launch (login start uses app.setLoginItemSettings), rollup (vite brings its own).
• tailwind-scrollbar: it was never registered in tailwind.config.js plugins, so the scrollbar-* classes in Modal produced no CSS. Those dead classes are removed too (generated CSS unchanged).
• @nethesis/nethesis-light-svg-icons, @nethesis/nethesis-brands-svg-icons: never imported (they are also GitHub-hosted, so install gets faster).
• motion: replaced by framer-motion in ProfileDialog (same 11.18.2 code). motion shipped its own internal copy of framer-motion and motion-dom, so the renderer bundled framer-motion twice: -258 kB of renderer JS. The two copies differ only in import paths; ProfileDialog uses only motion.div with animate (no AnimatePresence/MotionConfig context).
• @date-fns/utc: new UTCDate(...) replaced with new Date(Date.UTC(...)) in CallsDate and dateTime, as in nethvoice-cti#591. UTCDate's constructor is setTime(Date.UTC(...arguments)) and both values go straight into utcToZonedTime, which clones the timestamp. Checked on 3.36M comparisons (3 system time zones, 14 server offsets/zones, IT/EN, edge dates, NaN): zero differences.

Kept on purpose: the 4 native dependencies (externalized by electron-vite and packed by electron-builder), dmg-license, electron-builder-notarize and the @electron/notarize override (they need a macOS release to verify), moment, clsx/tailwind-merge.

Undeclared dependencies

• react-tooltip is now declared (^5.28.0, same version as before): CustomThemedTooltip imports it at runtime but it only resolved through @nethesis/phone-island.
• IconDefinition is imported from @fortawesome/fontawesome-svg-core instead of the undeclared @fortawesome/fontawesome-common-types.

Security updates (lockfile only, no major bumps of our dependencies)

@xmldom/xmldom, ws/engine.io-client, js-yaml 3.x, brace-expansion, minimatch, postcss-selector-parser, http-cache-semantics, @babel/* (all patch/minor within the declared ranges).

One transitive major: @types/jest 29.5.14 → 30.0.0 (with its type-only chain expect/jest-diff/pretty-format 30, ci-info 4). It is not ours: it comes from @nethesis/phone-island → @testing-library/jest-dom → @types/testing-library__jest-dom, which declares "@types/jest": "*". On main the 29.x chain (expect → jest-message-util → micromatch → braces) reports 4 high advisories. It is types only: nothing imports it, it is not in any bundle, and typecheck stays at 0 errors.

The libc fields that npm 10.9.8 strips from the lockfile were restored (14 entries, no libc line in the diff).

Still open, out of scope: Electron 28 (fixes need >= 38), react-router 7, node-forge (via win-ca) and jimp/file-type (via nut-js) which have no upstream fix.

Removed dead code

• Files never imported: hooks/useIsomorphicLayoutEffect.ts, ProfileDialog/NethVoiceLink.tsx, 5 unreferenced assets in src/renderer/src/assets.
• Unused exports: 23 helpers in lib/utils.ts, 8 in lib/dateTime.ts, isDeepEqual, Log.startTime/logTime/endTime, NetworkController.post, PhoneIslandController.{muteAudio,unmuteAudio,forceHide,forceShow,showPhoneIsland,hidePhoneIsland} (+ the isWarmingUp flag only set by forceHide), the empty NethVoiceAPI namespaces, Profiling, User.all, Phonebook.{updateSpeeddialBy,updateContact,deleteContact}, unused types.
• IPC: events with no sender or no listener (RECONNECT_PHONE_ISLAND, DEV_TOOL_TOGGLE_CONNECTION, EMIT_RINGTONE_LIST, INITIALIZATION_COMPELTED, TOGGLE_COMMAND_BAR, HIDE_LOGIN_WINDOW, SHOW/HIDE_PHONE_ISLAND, ON_CHANGE_THEME which nobody listened to; the main-side SHOW_COMMAND_BAR listener nobody sent to) and the matching unused preload bridge members. window.emit is only webContents.send and there is no dynamic IPC_EVENTS[...] access.
• Unused imports/locals, commented-out code, two dead CSS rules (#__next, #openDevToolButton).
• Not touched: store shape (persisted in user_data.json), Theme.ts, component props, hook subscriptions, phone-island events, translations, BaseWindow.addListener (used by feat(screen-share): let users choose which screen or window to share #238).

Results (clean npm ci + build, main vs this branch)

	main	this branch
npm audit (all / --omit=dev)	50 (21 high) / 10	34 (10 high) / 9
installed packages	1028	979
renderer JS	4,847 kB	4,589 kB
out/main/main.js / out/preload/index.js	1,379 / 260 kB	1,370 / 259 kB
renderer CSS		identical except the 2 dead rules
typecheck errors	0	0
eslint (errors / warnings)	1 / 341	1 / 267 (same pre-existing error)

electron-builder --linux --dir still packs the 4 native modules (@nut-tree-fork/nut-js, koffi, uiohook-napi, win-ca).

How to test

1. rm -rf node_modules out dist && npm ci && npm run build
2. npm run dev and follow the test cases in the comment below.

[tonyco97]

Test

Setup: rm -rf node_modules out dist && npm ci, then npm run dev with a NethVoice account that has a NethLink extension. Repeat the UI checks in light and dark theme, IT and EN.

Test Case 1 - Install and build

• npm ci completes without errors and without changing package.json / package-lock.json
• npm run build completes (typecheck with 0 errors + electron-vite build)
• CI builds on Linux, macOS and Windows are green

Test Case 2 - Login

• Login with username/password, with 2FA (OTP) and with SSO
• Logout and login again with a saved account; delete a saved account
• App restart: auto-login works, tray icon and NethLink window appear

Test Case 3 - Calls and phone island

• Incoming and outgoing call: phone island shows, resizes and hides after hangup; position is kept after moving it
• Transfer, listen and intrude from NethLink
• Start a call from a tel:/callto: link and from the command bar
• Change default device and preferred audio/video devices

Test Case 4 - Command bar

• Open/close with the configured shortcut (also the double-tap modifier); search contacts and operators, start a call

Test Case 5 - NethLink modules

• Phonebook: search, add contact (private/public/group), open contact details, copy number
• Speed dials: create, edit, delete; favourites filter
• Last calls and missed calls: time shown and "x ago" are correct (also announcements)
• Parking: parked calls appear with their animation, pick up a parked call
• Profile menu: the side page slide animation (presence, devices, theme, settings) works; presence change and forward
• Settings: incoming calls, ringtones (preview), shortcut change
• About: version shown, release notes and company links open in the browser

Test Case 6 - Theme and language

• Theme change (light/dark/system) is applied to NethLink, phone island and command bar
• Language change is applied

Test Case 7 - Tooltips and modals

• Tooltips (CustomThemedTooltip) show correctly in both themes
• Modals open, scroll and close as before

Test Case 8 - Packaged app

• Installers from CI start correctly on Linux, macOS and Windows (native modules: shortcut, window focus, clipboard, Windows certificates)

[github-actions]

Automatic builds from https://github.com/NethServer/nethlink/actions/runs/38724920837.
Commit: da4fc5b

Name	Platform	Link
win-app.exe	Windows (x64)	Link
macos-app-x64.dmg	MacOS (x64)	Link
macos-app-arm64.dmg	MacOS (arm64)	Link
linux-app.AppImage	Linux (x64)	Link

[tommaso-ascani]

LGTM. Note: the lockfile bumps @types/jest to 30 (major), not mentioned in the description.

[tonyco97]

@tommaso-ascani right, @types/jest 29 → 30 is a major. It is transitive (phone-island → @testing-library/jest-dom → @types/testing-library__jest-dom, which declares "@types/jest": "*"), types only (not in any bundle, typecheck still 0 errors) and it clears the 4 high advisories of the 29.x chain (expect → jest-message-util → micromatch → braces). I kept it and updated the description to say so.