Epic Stack catch-up 6/7: Vite 7 + Vitest 4 + remaining majors

[cursor]

Parent issue: #23

Parent: search for issue titled “Epic Stack catch-up: tracking”. Do this only after package 5 is on dev (server boot / Express 5). Packages 1–4 should already be merged.

Goal

Bring remaining dependencies in line with current Epic Stack without removing this site’s extra UI packages and without the routing convention migration (package 7).

Use Epic Stack package.json as the version menu, not as a file to copy.

Epic Stack reference: https://github.com/epicweb-dev/epic-stack/blob/main/package.json
Their bulk bumps: epicweb-dev/epic-stack#1081 epicweb-dev/epic-stack#1084

Do this

Branch off origin/dev. PR into dev. Prefer one PR, but if CI explodes, split majors (Vite/Vitest vs Sentry vs the rest) rather than mixing in routing.

Keep (do not remove)

@dnd-kit/core, @dnd-kit/modifiers, @dnd-kit/sortable, @dnd-kit/utilities, @radix-ui/react-avatar, @radix-ui/react-dialog, @radix-ui/react-select, @radix-ui/react-separator, @radix-ui/react-switch, @radix-ui/react-tabs, @radix-ui/react-toggle, @radix-ui/react-toggle-group, @tabler/icons-react, @tanstack/react-table, lucide-react, next-themes, react-scan, recharts, vaul, @react-router/remix-routes-option-adapter, remix-flat-routes

You may bump those extras to current compatible versions if needed for peer deps. Do not delete them.

Target majors / notables (from Epic Stack HEAD, verify current npm)

Package	This repo (approx)	Epic Stack (Aug 2026)
vite	6.2	7.3
vitest / @vitest/coverage-v8	3.0	4.0
@vitejs/plugin-react	4.3	5.1
@sentry/react-router, @sentry/profiling-node	9.8	10.38
prisma / @prisma/client / @prisma/instrumentation	6.5	6.19 (stay on Prisma 6, do not jump to 7)
remix-utils	8.5	9.0 (check honeypot imports)
openimg	0.7	1.1 (check Img API)
@react-email/components	0.0.34	1.0
zod	3.25	stay on 3.x (Epic Stack still 3.25.x)
tailwind-merge	2.6	3.4
dotenv	16	17
cross-env	7	10
glob / mime-types / set-cookie-parser	see Epic Stack	match 3.x majors if tests pass
react / react-dom	19.0	19.2
typescript	5.8	5.9
@playwright/test	1.51	current 1.x
@conform-to/*	1.4	1.16 (minor; include)

Also add react-router-devtools as a devDependency and reactRouterDevTools() in vite.config.ts like Epic Stack (dev-only). Keep localtunnel allowedHosts and hidden Sentry sourcemaps.

Optional in this PR (small): drop duplicate #app/* / #tests/* from tsconfig.json paths (keep package.json "imports"). Stop if shadcn components.json or IDE resolution breaks — Epic Stack issue epicweb-dev/epic-stack#1060 is a known footgun. If you skip, say so in the PR.

Do not add react-router-auto-routes or remove remix-flat-routes here.

How to bump

1. Align versions to Epic Stack for packages we share
2. npm install
3. Fix compile errors at the cause (import paths, Vite 7 / Vitest 4 config)
4. Keep engines.node at ^22.18.0 if package 5 already set it

Vitest 4: update vite.config.ts test block as required by Vitest 4. Do not drop tests/setup/*.

Sentry 10: keep package 2’s hidden maps + sentry-event-filters. Update PrismaInstrumentation import if Sentry 10 + Prisma 6.19 want the named export.

Files allowed

• package.json, package-lock.json
• Config that the bumps require: vite.config.ts, vitest config if split, tsconfig.json, playwright.config.ts, react-router.config.ts (e.g. routeDiscovery: { mode: 'initial' } if RR 7.18+ wants it — Epic Stack has this)
• Source files only where APIs broke (openimg, remix-utils honeypot, Sentry 10, @react-email/components)
• Do not rewrite dashboard features; mechanical import fixes in dashboard files are OK if a shared API changed

Do not

• Do not remove extra UI deps
• Do not migrate app/routes to auto-routes
• Do not copy Epic Stack app/routes/_marketing over this site
• Do not bump Prisma to 7
• Do not bump Zod to 4

Acceptance

• Shared deps are at or near Epic Stack versions; extras still present
• npm run build, typecheck, lint, test -- --run pass; Playwright green
• Localtunnel + Sentry hidden maps still configured
• PR targets dev

Staging smoke (human) — required

• Full pass: home, auth, notes images, dashboard CRUD, theme toggle, Sentry still receiving events if DSN set

---

PR target: dev (never main). Implement only this issue.