[ConsoleTVs]

Summary

Node 25 → 26.12.1
Babel 7 → 8 · Vitest/coverage 4 → 5 · React 19.2 → 19.3
remaining dev tools → latest stable
TypeScript → retain 6.0.3 for declaration-tooling compatibility

Update every compatible development dependency and regenerate the lockfile. Preserve published Node/framework peer requirements; only the contributor toolchain minimum changes.

Keep Vitest 4's mock-clearing behavior explicitly: Vitest 5's new global clearing default resets mocks belonging to active concurrent sibling tests. Scope new React globals/immutability rule exceptions to test fixtures, with one targeted negative-hook-fixture exception. Production React rules remain enabled. Use an explicit config import extension for Vite's native loader.

Evidence

• Before: 16 dependency audit findings; all 113 existing tests pass under the original dependency set on Node 26.
  After: Clean npm ci, 113 tests pass, coverage passes, npm audit reports zero vulnerabilities, and the dependency tree has no invalid peers. Registry comparison shows TypeScript is the only dev dependency not at its latest stable release.
• Lint, formatting, full build, isolated React/core TypeScript checking, and ESM/CommonJS core/React export smoke checks pass. Coverage: 94.84% statements, 93.06% branches.
• TypeScript 7 trial: declaration generation initially fails because the JavaScript compiler API is absent. The plugin-supported TypeScript 6 compatibility package allows builds, but Volar's <7 peer constraints still produce an invalid dependency tree. Retain supported TypeScript 6 rather than force incompatible peers; rationale is documented in AGENTS.md.
• Existing Solid/React JSX TS2786 diagnostics remain printed by declaration generation despite successful builds. Existing negative-timeout test warnings remain. No production-source implementation changes.

Merge Danger

Door: two-way

Blast Radius: tooling

Contributors and CI require Node 26.12.1+. Published runtime engines and framework peer ranges are unchanged. New major versions of Babel/Vitest are covered by builds, runtime export smoke checks, and the complete test suite. No ticket.