🔀 Merge dependency security fixes into prod

Author: InTheNooB

.eslintrc.json

@@ -4,7 +4,7 @@
     "es2021": true
   },
   "parser": "@typescript-eslint/parser",
-  "extends": ["standard-with-typescript", "plugin:react/recommended"],
+  "extends": ["standard", "plugin:@typescript-eslint/recommended-type-checked", "plugin:react/recommended"],
   "parserOptions": {
     "ecmaVersion": "latest",
     "sourceType": "module",
@@ -19,7 +19,6 @@
     "import/no-absolute-path": "off",
     "import/no-duplicates": "off",
     "react/react-in-jsx-scope": "off",
-    "@typescript-eslint/indent": "off",
     "react/prop-types": "off",
     "@typescript-eslint/explicit-function-return-type": "off",
     "@typescript-eslint/strict-boolean-expressions": "off"

.github/workflows/deploy.yml

@@ -13,11 +13,23 @@ jobs:
       - name: '[⚙️] Checkout'
         uses: actions/checkout@v3
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: pnpm
+
       - name: '[📦] Install dependencies'
-        run: npm install
+        run: pnpm install --frozen-lockfile
+
+      - name: Audit dependencies
+        run: pnpm audit
 
       - name: '[🔧] Build'
-        run: npm run build
+        run: pnpm run build
 
       - name: '[🚀] Deploy to support-informatique.ch'
         uses: appleboy/scp-action@master

.github/workflows/lint.yml

@@ -13,15 +13,25 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Use Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '24'
+          cache: pnpm
 
       - name: Install dependencies
         run: |
-          npm ci
+          pnpm install --frozen-lockfile
+
+      - name: Audit dependencies
+        run: pnpm audit
+
+      - name: Check types
+        run: pnpm run typecheck
 
       - name: Run ESLint
         run: |
-          npm run lint
+          pnpm run lint

README.md

@@ -27,16 +27,22 @@ We follow the best practices for CI/CD using GitHub Actions.
 
 ### Linting Check
 
-Every push to the `main` branch triggers a linting check using the `npm run lint` command. This helps in maintaining a clean, error-free codebase.
+Every push to the `main` branch installs the committed pnpm lockfile with `pnpm install --frozen-lockfile`, audits dependencies, checks types, and runs `pnpm run lint`.
 
 ![lint](https://github.com/Support-Informatique/support-informatique.ch/actions/workflows/lint.yml/badge.svg)
 
 ### Automatic Deployment
 
-Any push to the `prod` branch triggers an automatic deployment to our live site. Before the deployment, we also run a `npm run lint` command to ensure that the production version is error-free and ready for deployment.
+Any push to the `prod` branch triggers an automatic deployment to both live sites. CD uses Node.js 24 and the pinned pnpm version to install `pnpm-lock.yaml` with `--frozen-lockfile`, runs `pnpm audit`, and builds with `pnpm run build` (including lint and TypeScript checks).
 
 ![deploy](https://github.com/Support-Informatique/support-informatique.ch/actions/workflows/deploy.yml/badge.svg)
 
+## Dependency maintenance
+
+Use pnpm (the version in `packageManager`) and commit `pnpm-lock.yaml`; there is no npm lockfile. Run `pnpm audit`, `pnpm typecheck`, and `pnpm build` after updates.
+
+React Router 7 and Vite 6 replace the vulnerable older versions. Tailwind CSS 4 and TypeScript ESLint 8 remove the unpatched `braces` dependency. Tailwind uses `@tailwindcss/postcss`, loads the existing theme through `@config`, and declares dynamic mountain backgrounds with `@source inline`. The CSS requires Safari 16.4+, Chrome 111+, or Firefox 128+. The YAML override keeps Vite's dependency on a patched release.
+
 ## 📖 License
 
 This project is [MIT](https://choosealicense.com/licenses/mit/) licensed.