[CarlosNZ]

Closes #258. Remaining to-dos are tracked in #408.

Eight commits, one per logical batch, in dependency order. Every batch was verified with pnpm test, pnpm compile, pnpm -r build (lint + tree-shake guards) and, where relevant, pnpm pack-all plus the demo in all four resolution modes and a Chrome check.

Workspace (core + themes + components + utils)

Commit	What
In-range refresh	Every patch/minor inside existing ranges: rollup 4.63, typescript-eslint 8.70, react 19.3, ts-jest, rollup-plugin-dts, @uiw codemirror set, react-colorful, colord 2.10 (closes its ReDoS advisory). Drops unused root devDeps fs-extra and ts-node. Components' runtime dependencies ranges keep their original floors — only the lockfile resolutions move.
@types/react 19.3.0 + csstype 3.2.3	Both pnpm.overrides moved in lockstep with the demo's yarn resolution (the demo's tsconfig maps into workspace src/, so mismatched copies produce type-identity errors). Demo lockfile deduped to a single csstype.
Rollup plugin majors	@rollup/plugin-terser 1.0, @rollup/plugin-typescript 12.3, esbuild 0.28. Bundle output byte-identical.
Replace rollup-plugin-styles	The plugin (Jan 2022, rollup 2 peer, stale postcss/cssnano tree carrying the last audit finding) was only used to read a .css file and emit a minified string. scripts/rollup-inline-css.mjs does that with esbuild's CSS minifier, which was already a devDep. Shared by core and components; per-config stripCssQuery helpers removed. Core's inlined CSS is 5368 bytes before and after. Removes 137 packages from the lockfile.
Jest 30	jest, jest-environment-jsdom (jsdom 20 → 26), @types/jest. All 750 tests pass unchanged.
ESLint 10	eslint 10, @eslint/js 10, globals 17, eslint-plugin-react-hooks 7. Hooks rules listed explicitly rather than via the v7 preset (which also enables the React Compiler rules). settings.react.version pinned to 19.3.0 because eslint-plugin-react 7.37.5's auto-detection calls the removed getFilename(); a peerDependencyRules entry silences the peer warning. Both are commented and tracked in #408. One new no-useless-assignment finding fixed in assign.ts.

Workspace audit: 31 findings → 0.

Demo

Commit	What
In-range refresh	yarn upgrade — lockfile only. ajv 8.20, vite 6.4.3, eslint 9.39.5, wouter, shiki, etc.
Majors	firebase 10 → 12 (drops undici, the last advisory source), vite 7 + @vitejs/plugin-react 5, eslint 10 stack mirroring core, typescript ^5.9, cross-env removed (unreferenced). react-refresh 0.5 exempted for src/main.tsx (entry module, no exports).

Demo audit: 168 findings (5 critical) → 0.

Docs

CLAUDE.md (root + components), dev-docs/package-management-guide.md and the relevant source comments describe the new CSS wiring and the updated pins.

Not included

Chakra 3, framer-motion 13, react-datepicker 9, Vite 8, TypeScript 6/7, jest-dom 7 (needs Node 22), pnpm 11/12, Node 22 — see #408 for the reasoning on each.

Also carries 049fe09 (utils version bump to 0.9.0-beta.3), which was already on this branch.

🤖 Generated with Claude Code

[github-actions]

Bundle size impact

json-edit-react

Format	Base raw	PR raw	Δ raw	Base gzip	PR gzip	Δ gzip
esm	58.79 KB	58.79 KB	🟢 -4 B (-0.01%)	20.82 KB	20.82 KB	🔺 +1 B (+0.00%)
cjs	60.23 KB	60.23 KB	🟢 -4 B (-0.01%)	20.83 KB	20.83 KB	🔺 +3 B (+0.01%)

@json-edit-react/themes

Format	Base raw	PR raw	Δ raw	Base gzip	PR gzip	Δ gzip
esm	35.38 KB	35.38 KB	⚪ no change	10.88 KB	10.88 KB	⚪ no change
cjs	34.52 KB	34.52 KB	⚪ no change	10.83 KB	10.83 KB	⚪ no change

@json-edit-react/components

Format	Base raw	PR raw	Δ raw	Base gzip	PR gzip	Δ gzip
esm	15.77 KB	15.76 KB	🟢 -12 B (-0.07%)	5.33 KB	5.32 KB	🟢 -10 B (-0.18%)
cjs	16.40 KB	16.39 KB	🟢 -12 B (-0.07%)	5.17 KB	5.17 KB	🟢 -9 B (-0.17%)

@json-edit-react/utils

Format	Base raw	PR raw	Δ raw	Base gzip	PR gzip	Δ gzip
esm	5.03 KB	5.03 KB	⚪ no change	2.23 KB	2.23 KB	⚪ no change
cjs	5.13 KB	5.13 KB	⚪ no change	2.22 KB	2.22 KB	⚪ no change

_{Measured from build/index.{cjs,esm}.js. Gzip at level 9.}