feat(deps): L3-0000 bundled dependabot updates from passing CI runs

[scottdickerson]

Jira ticket

N/A — dependency housekeeping. Consolidates 24 open Dependabot PRs whose CI was passing.

Screenshots

Before	After
N/A — no runtime UI changes. Verify via Chromatic diff on this PR.	N/A — verify via Chromatic diff on this PR.

Figma link

N/A — no design changes.

Summary

Consolidates 24 open Dependabot PRs whose CI passed into a single, reviewable diff, reducing the review-and-merge overhead of dealing with each dependency bump individually.

Explicitly excluded (their CI was failing on the dependabot branches themselves):

• build(deps-dev): L3-0000 bump vite to 8 and merge React 19 upgrade #907 vite + @vitejs/plugin-react — build failures
• fix(deps): bump markdown-it and markdownlint-cli #904 markdown-it / markdownlint-cli — mixed failures
• build(deps-dev): bump react-dom and @types/react-dom #808 react-dom + @types/react-dom (major bumps) — CI failed
• build(deps-dev): bump @eslint/js from 9.39.2 to 10.0.1 #807 @eslint/js (major bump) — CI failed

WHY: A bundled bump is easier to validate downstream in a single Chromatic + phillips-public-remix smoke test than 24 individual merges. Grouping into one PR also collapses one lockfile re-resolution instead of 24 sequential ones.

Change List (describe the changes made to the files)

Direct dependency bumps in package.json:

• dompurify ^3.2.4 → ^3.4.12 (fix(deps): bump dompurify from 3.2.4 to 3.4.12 #899, supersedes fix(deps): bump dompurify and @types/dompurify #819)
• @types/dompurify ^3.0.5 → ^3.2.0 (fix(deps): bump dompurify and @types/dompurify #819)
• uuid ^11.1.0 → ^14.0.0 (fix(deps): bump uuid from 11.1.0 to 14.0.0 #855)
• react-zoom-pan-pinch ^3.6.1 → ^3.7.0 (fix(deps): bump react-zoom-pan-pinch from 3.6.1 to 3.7.0 #811)
• @commitlint/config-conventional ^19.2.2 → ^20.4.1 (build(deps-dev): bump @commitlint/config-conventional from 19.2.2 to 20.4.1 #810)
• prettier 3.3.3 → 3.8.1 (build(deps-dev): bump prettier from 3.3.3 to 3.8.1 #809)

Transitive lockfile-only bumps (18 PRs) applied via npm update --package-lock-only targeting the specific packages Dependabot proposed:

ws #906, postcss #905, form-data #903, fast-uri #902, immutable #900, svgo #898, linkify-it #897, axios #896, js-yaml #889, undici #887, qs #873, follow-redirects #844, lodash + @microsoft/api-extractor #842, picomatch #840, lodash-es #839, handlebars #837, flatted #832, tar + npm #824.

Prettier 3.8 cosmetic reformats (no behavior change):

• src/components/Dropdown/Dropdown.tsx — single-line multi-extends interface
• src/scss/_vars.scss — leading-newline style for the long $text-tokens list
• .cursor/**/*.md — minor markdown normalization

Acceptance Test (how to verify the PR)

1. CI on this PR passes (build + lint + unit tests + Chromatic).
2. Review the Chromatic UI diff — approve baselines only if any visual differences are cosmetic/expected.
3. Bump @phillips/seldon in phillips-public-remix to a preview version of this branch and smoke-test the following pages/flows:
   • Any page rendering RichText / Portable Text (exercises dompurify 3.2 → 3.4)
   • Toast notifications (exercises uuid v11 → v14 via ToastContextProvider)
   • Any page using react-zoom-pan-pinch (image zoom lots)
4. If green, merge and close the 24 bundled Dependabot PRs.

Regression Test

• Run the full unit test suite locally after bumping in the consumer app: npm test.
• Verify the Filter dropdowns still auto-apply sort (recently landed via PDD-289) — the auto-apply chain doesn't intersect with any of the bumped packages, but worth a smoke test.
• Verify commit still works via husky since @commitlint/config-conventional went 19 → 20 (this very commit already validates that path).

Evidence of testing

Local verification against main + this branch:

• npm run build → exit 0 (tsc + vite build)
• npm run lint → exit 0 (tsc --noEmit, eslint, stylelint, markdownlint)
• npx vitest run --project=unit → 1042 / 1042 tests passing
• Pre-push storybook hook — 238 / 238 storybook tests passing

Notable risk areas to spot-check during review:

• uuid v11 → v14 (3 major versions). Used in src/components/Toast/ToastContextProvider.tsx via v4 as uuidv4. The v4() API is stable across all uuid majors, but worth verifying the Toast story in Chromatic.
• @commitlint/config-conventional 19 → 20 — dev-only; affects commit-message linting. Husky commit-msg hook accepted this commit, so v20 rules are compatible with the current commit convention.
• prettier 3.3 → 3.8 — cosmetic reformats visible in diff; anyone with in-flight PRs should rebase.
• dompurify 3.2 → 3.4 — check any HTML sanitization surfaces in Chromatic.

Things to look for during review

• PR title should correctly describe the most significant type of commit. I.e. feat(scope): ... if a minor release should be triggered.
• All commit messages follow convention and are appropriate for the changes
• All references to phillips class prefix are using the prefix variable
• All major areas have a data-testid attribute.
• Document all props with jsdoc comments
• All strings should be translatable.
• Unit tests should be written and should have a coverage of 90% or higher in all areas.

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for phillips-seldon ready!

Name	Link
🔨 Latest commit	241d8fb
🔍 Latest deploy log	https://app.netlify.com/projects/phillips-seldon/deploys/6a6797f8778d510008e5a5da
😎 Deploy Preview	https://deploy-preview-908--phillips-seldon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chromatic-com]

Tip

All tests passed and all changes approved!

🟢 UI Tests: 4 visual and accessibility changes accepted as baselines
🟢 UI Review: Approved by Scott Dickerson
Storybook Publish: 238 stories published

[github-actions]

🚀 Storybook preview is ready.

• Preview: https://68b9f094608b90f3cfec5a06-whvfvsjuev.chromatic.com/
• Chromatic build: https://www.chromatic.com/build?appId=68b9f094608b90f3cfec5a06&number=660

[Copilot]

Pull request overview

This PR consolidates multiple Dependabot updates into a single dependency-housekeeping change for the Seldon React + TypeScript component library, with a small amount of Prettier-driven formatting churn.

Changes:

• Bumped several direct dependencies/devDependencies (notably dompurify, uuid, react-zoom-pan-pinch, @commitlint/config-conventional, prettier) and re-resolved the lockfile for a batch of transitive updates.
• Applied Prettier formatting-only updates to a small set of TS/SCSS files.
• Normalized minor markdown formatting in .cursor/ command/agent docs.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package.json	Direct dependency/devDependency version bumps.
package-lock.json	Lockfile re-resolution reflecting bundled Dependabot updates (direct + transitive).
src/components/Dropdown/Dropdown.tsx	Prettier-only formatting of the DropdownProps interface extends clause.
src/scss/_vars.scss	Prettier-only reformat of the long $text-tokens list for readability.
.cursor/commands/run-tests-and-fix-failure.md	Markdown normalization (removed empty list spacing lines).
.cursor/commands/new-feature.md	Markdown normalization (removed empty list spacing lines).
.cursor/commands/lint-and-format.md	Markdown normalization (removed empty list spacing lines).
.cursor/agents/test-coverage-checker.md	Markdown normalization (removed empty list spacing lines).
.cursor/agents/playwright-route-checker.md	Markdown normalization (removed empty list spacing lines).
.cursor/agents/component-unit-test-checker.md	Markdown normalization (removed empty list spacing lines).
.cursor/agents/component-storybook-checker.md	Markdown normalization (removed empty list spacing lines).

[scottdickerson]

Good catch — done in 241d8fb. Removed @types/dompurify entirely (dompurify 3.x provides its own types, and nothing in src/ imports it directly either).

[adietrich3074]

LGTM

[davidicus]

🎉 This PR is included in version 1.277.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀