chore: upgrade npm packages for security and stability

Backend upgrades:
- i18next: 25.3.1 → 25.3.2 (patch)
- bcrypt: 5.1.1 → 6.0.0 (maintains compatibility)
- nodemailer: 6.10.1 → 7.0.5 (no AWS SES impact)
- sharp: 0.32.6 → 0.34.3 (image processing)
- chokidar: 3.6.0 → 4.0.3 (file watching)

Frontend upgrades:
- date-fns: 2.30.0 → 4.1.0 (date utilities)
- lucide-react: 0.292.0 → 0.525.0 (icons)
- react-toastify: 9.1.3 → 11.0.5 (notifications)

All upgrades tested, 0 npm audit vulnerabilities maintained.
Deferred high-risk upgrades (archiver, React 19, Express 5).

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/package.json

@@ -21,8 +21,8 @@
     "adm-zip": "^0.5.16",
     "archiver": "^5.3.1",
     "axios": "^1.10.0",
-    "bcrypt": "^5.1.0",
-    "chokidar": "^3.5.3",
+    "bcrypt": "6.0.0",
+    "chokidar": "4.0.3",
     "cors": "^2.8.5",
     "dotenv": "^16.0.3",
     "express": "^4.18.2",
@@ -31,7 +31,7 @@
     "form-data": "^4.0.4",
     "handlebars": "^4.7.8",
     "helmet": "^7.0.0",
-    "i18next": "^25.3.1",
+    "i18next": "25.3.2",
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-http-backend": "^3.0.2",
     "joi": "^17.9.1",
@@ -41,10 +41,10 @@
     "mime-types": "^3.0.1",
     "multer": "^2.0.2",
     "node-cron": "^3.0.2",
-    "nodemailer": "^6.9.1",
+    "nodemailer": "7.0.5",
     "pg": "^8.16.3",
     "react-i18next": "^15.6.0",
-    "sharp": "^0.32.0",
+    "sharp": "0.34.3",
     "sqlite3": "^5.1.6",
     "uuid": "^11.1.0",
     "winston": "^3.8.2",

frontend/package-lock.json

@@ -22,7 +22,7 @@
         "@types/react-google-recaptcha": "^2.1.9",
         "axios": "^1.3.2",
         "clsx": "^2.0.0",
-        "date-fns": "^2.29.3",
+        "date-fns": "4.1.0",
         "dompurify": "^3.2.6",
         "i18next": "^25.3.1",
         "i18next-browser-languagedetector": "^8.2.0",
@@ -30,7 +30,7 @@
         "js-cookie": "^3.0.5",
         "lodash": "^4.17.21",
         "lowlight": "^2.9.0",
-        "lucide-react": "^0.292.0",
+        "lucide-react": "0.525.0",
         "react": "^18.3.1",
         "react-countdown": "^2.3.5",
         "react-dom": "^18.3.1",
@@ -39,7 +39,7 @@
         "react-image-gallery": "^1.2.11",
         "react-intersection-observer": "^9.4.3",
         "react-router-dom": "^6.8.0",
-        "react-toastify": "^9.1.1",
+        "react-toastify": "11.0.5",
         "tailwind-merge": "^3.3.1"
       },
       "devDependencies": {
@@ -2860,19 +2860,13 @@
       "license": "MIT"
     },
     "node_modules/date-fns": {
-      "version": "2.30.0",
-      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-2.30.0.tgz",
-      "integrity": "sha512-fnULvOpxnC5/Vg3NCiWelDsLiUc9bRwAPs/+LfTLNvetFCtCTN+yQz15C/fs4AwX1R9K5GLtLfn8QW+dWisaAw==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-4.1.0.tgz",
+      "integrity": "sha512-Ukq0owbQXxa/U3EGtsdVBkR1w7KOQ5gIBqdH2hkvknzZPYvBxb/aa6E8L7tmjFtkwZBu3UXBbjIgPo/Ez4xaNg==",
       "license": "MIT",
-      "dependencies": {
-        "@babel/runtime": "^7.21.0"
-      },
-      "engines": {
-        "node": ">=0.11"
-      },
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/date-fns"
+        "type": "github",
+        "url": "https://github.com/sponsors/kossnocorp"
       }
     },
     "node_modules/debug": {
@@ -4119,12 +4113,12 @@
       }
     },
     "node_modules/lucide-react": {
-      "version": "0.292.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.292.0.tgz",
-      "integrity": "sha512-rRgUkpEHWpa5VCT66YscInCQmQuPCB1RFRzkkxMxg4b+jaL0V12E3riWWR2Sh5OIiUhCwGW/ZExuEO4Az32E6Q==",
+      "version": "0.525.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.525.0.tgz",
+      "integrity": "sha512-Tm1txJ2OkymCGkvwoHt33Y2JpN5xucVq1slHcgE6Lk0WjDfjgKWor5CdVER8U6DvcfMwh4M8XxmpTiyzfmfDYQ==",
       "license": "ISC",
       "peerDependencies": {
-        "react": "^16.5.1 || ^17.0.0 || ^18.0.0"
+        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
     "node_modules/markdown-it": {
@@ -5080,25 +5074,16 @@
       }
     },
     "node_modules/react-toastify": {
-      "version": "9.1.3",
-      "resolved": "https://registry.npmjs.org/react-toastify/-/react-toastify-9.1.3.tgz",
-      "integrity": "sha512-fPfb8ghtn/XMxw3LkxQBk3IyagNpF/LIKjOBflbexr2AWxAH1MJgvnESwEwBn9liLFXgTKWgBSdZpw9m4OTHTg==",
+      "version": "11.0.5",
+      "resolved": "https://registry.npmjs.org/react-toastify/-/react-toastify-11.0.5.tgz",
+      "integrity": "sha512-EpqHBGvnSTtHYhCPLxML05NLY2ZX0JURbAdNYa6BUkk+amz4wbKBQvoKQAB0ardvSarUBuY4Q4s1sluAzZwkmA==",
       "license": "MIT",
       "dependencies": {
-        "clsx": "^1.1.1"
+        "clsx": "^2.1.1"
       },
       "peerDependencies": {
-        "react": ">=16",
-        "react-dom": ">=16"
-      }
-    },
-    "node_modules/react-toastify/node_modules/clsx": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/clsx/-/clsx-1.2.1.tgz",
-      "integrity": "sha512-EcR6r5a8bj6pu3ycsa/E/cKVGuTgZJZdsyUYHOksG/UHIiKfjxzRxYJpyVBwYaQeOvghal9fcc4PidlgzugAQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
+        "react": "^18 || ^19",
+        "react-dom": "^18 || ^19"
       }
     },
     "node_modules/read-cache": {

frontend/package.json

@@ -25,7 +25,7 @@
     "@types/react-google-recaptcha": "^2.1.9",
     "axios": "^1.3.2",
     "clsx": "^2.0.0",
-    "date-fns": "^2.29.3",
+    "date-fns": "4.1.0",
     "dompurify": "^3.2.6",
     "i18next": "^25.3.1",
     "i18next-browser-languagedetector": "^8.2.0",
@@ -33,7 +33,7 @@
     "js-cookie": "^3.0.5",
     "lodash": "^4.17.21",
     "lowlight": "^2.9.0",
-    "lucide-react": "^0.292.0",
+    "lucide-react": "0.525.0",
     "react": "^18.3.1",
     "react-countdown": "^2.3.5",
     "react-dom": "^18.3.1",
@@ -42,7 +42,7 @@
     "react-image-gallery": "^1.2.11",
     "react-intersection-observer": "^9.4.3",
     "react-router-dom": "^6.8.0",
-    "react-toastify": "^9.1.1",
+    "react-toastify": "11.0.5",
     "tailwind-merge": "^3.3.1"
   },
   "devDependencies": {

package-upgrade-summary-2025-07-22.md

@@ -0,0 +1,45 @@
+# Package Upgrade Summary - Production System
+Date: 2025-07-22
+
+## ✅ Successfully Upgraded (8 packages)
+
+### Phase 1 (Low Risk):
+**Backend:**
+- i18next: 25.3.1 → 25.3.2
+- bcrypt: 5.1.1 → 6.0.0
+- nodemailer: 6.10.1 → 7.0.5
+
+**Frontend:**
+- date-fns: 2.30.0 → 4.1.0
+- lucide-react: 0.292.0 → 0.525.0
+
+### Phase 2 (Medium Risk - Carefully Tested):
+**Backend:**
+- sharp: 0.32.6 → 0.34.3
+- chokidar: 3.6.0 → 4.0.3
+
+**Frontend:**
+- react-toastify: 9.1.3 → 11.0.5
+
+## 🚫 Deferred Upgrades (High Risk)
+
+### Critical Bug Found:
+- **archiver**: MUST stay at 5.3.2 (v7 has append() bug that breaks watermarks)
+
+### Major Breaking Changes:
+- express 4 → 5
+- knex 2 → 3
+- React 18 → 19
+- tailwindcss 3 → 4
+
+## Security Status
+- **npm audit vulnerabilities: 0** ✅
+- All upgraded packages tested and working
+- No known security issues in current packages
+
+## Backup Locations
+- Phase 1: `/backups/phase1-upgrade-20250722-103923/`
+- Phase 2: `/backups/phase2-upgrade-20250722-104940/`
+
+## Production Ready
+All upgrades have been tested and are ready for production deployment. Monitor closely for 48 hours after deployment.