Consolidate reviewed React and web toolchain upgrades

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
           python-version: "3.11"
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "20"
+          node-version: "22.22.2"
           cache: npm
       - run: python -m venv .venv && .venv/bin/python -m pip install -e '.[dev]'
       - run: npm ci
@@ -46,7 +46,7 @@ jobs:
           ref: ${{ inputs.source_ref || github.sha }}
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "20"
+          node-version: "22.22.2"
           cache: npm
       - run: npm ci
       - run: npm run test:web

.github/workflows/desktop-artifacts.yml

@@ -38,7 +38,7 @@ jobs:
           python-version: "3.11"
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "20"
+          node-version: "22.22.2"
           cache: npm
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable 2026-08-05
       - name: Install build dependencies

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Proofline changelog
 
+## Unreleased
+
+- Align development and CI Node.js with jsdom 30 requirements.
+- Upgrade React/ReactDOM and their types together with the Vite/React-plugin/jsdom toolchain; deduplicate the workspace runtime.
+- Preserve spacing in navigation accessible names and recognize the narrow React 19 production diagnostic URL path in the static egress check.
+- Rebuild the packaged web bundle from the upgraded toolchain.
+
 ## [2.0.2] - 2026-08-24
 
 ## [2.0.1] - 2026-08-24

apps/api/proofline/web/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="description" content="Proofline — evidence-backed engineering memory" />
     <title>Proofline</title>
-    <script type="module" crossorigin src="/assets/index-B6UyXvhp.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-Cq2uTymx.css">
+    <script type="module" crossorigin src="/assets/index-Cp1e0j7h.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-C1wsYag2.css">
   </head>
   <body>
     <div id="root"></div>

apps/web/package.json

@@ -12,19 +12,22 @@
   },
   "dependencies": {
     "lucide-react": "^0.468.0",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1"
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0"
   },
   "devDependencies": {
     "@playwright/test": "^1.61.1",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.1.0",
-    "@types/react": "^18.3.12",
-    "@types/react-dom": "^18.3.1",
-    "@vitejs/plugin-react": "^4.3.4",
-    "jsdom": "^25.0.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.2",
+    "jsdom": "^30.1.2",
     "typescript": "^5.7.2",
-    "vite": "^6.4.3",
+    "vite": "^8.3.3",
     "vitest": "^4.1.11"
+  },
+  "engines": {
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   }
 }

apps/web/scripts/check-egress.mjs

@@ -20,6 +20,10 @@ function isApprovedAbsoluteUrl(rawUrl) {
     const url = new URL(rawUrl);
     if (LOOPBACK_HOSTS.has(url.hostname)) return true;
     if (url.hostname === "www.w3.org") return true;
+    if (
+      url.protocol === "https:" && url.host === "react.dev" &&
+      !url.username && !url.password && /^\/errors\/(?:[0-9]+)?$/u.test(url.pathname)
+    ) return true;
     return (
       url.hostname === "reactjs.org" &&
       url.pathname === "/docs/error-decoder.html"

apps/web/scripts/check-egress.test.mjs

@@ -36,7 +36,15 @@ test("allows inert standards namespaces and React production diagnostics", () =>
     'const svgNamespace = "http://www.w3.org/2000/svg";',
     'const xlinkNamespace = "http://www.w3.org/1999/xlink";',
     'const decoder = "https://reactjs.org/docs/error-decoder.html?invariant=31";',
+    'const react19Prefix = "https://react.dev/errors/";',
+    'const react19Decoder = "https://react.dev/errors/31?args[]=object";',
   ].join("\n");
 
   assert.deepEqual(findDisallowedUrls(text), []);
 });
+
+test("keeps non-diagnostic React URLs and lookalike hosts blocked", () => {
+  for (const url of ["https://react.dev/api/collect", "https://react.dev/errors/31/more", "https://react.dev.evil.test/errors/31", "http://react.dev/errors/31", "https://react.dev:8443/errors/31"]) {
+    assert.equal(findDisallowedUrls(`fetch("${url}")`).length, 1, url);
+  }
+});

apps/web/src/App.tsx

@@ -413,7 +413,7 @@ function Nav({
       onClick={onClick}
     >
       {icon}
-      <span>{children}</span>
+      <span>{children}</span>{" "}
       {count !== undefined && <b>{count}</b>}
     </button>
   );

docs/getting-started.md

@@ -4,7 +4,7 @@
 
 ### Requirements and install
 
-Use Python 3.11 or newer, `uv`, Node.js 20 or newer, and npm. Repository development uses an isolated virtual environment; it does not require a global `proofline` install.
+Use Python 3.11 or newer, `uv`, Node.js 22.22.2 (or compatible 24.15+/26+), and npm. Repository development uses an isolated virtual environment; it does not require a global `proofline` install.
 
 ```bash
 git clone https://github.com/thangldw/proofline
@@ -39,7 +39,7 @@ Next: [architecture](architecture.md), [decision lifecycle](decision-lifecycle.m
 
 ### Yêu cầu và cài đặt
 
-Dùng Python 3.11 trở lên, `uv`, Node.js 20 trở lên và npm. Development từ repository dùng virtual environment độc lập; không cần cài global `proofline`.
+Dùng Python 3.11 trở lên, `uv`, Node.js 22.22.2 (hoặc bản tương thích 24.15+/26+) và npm. Development từ repository dùng virtual environment độc lập; không cần cài global `proofline`.
 
 ```bash
 git clone https://github.com/thangldw/proofline
@@ -74,7 +74,7 @@ Tiếp theo: [architecture](architecture.md), [decision lifecycle](decision-life
 
 ### 要件と install
 
-Python 3.11 以上、`uv`、Node.js 20 以上、npm を使います。Repository development は独立 virtual environment を使い、global `proofline` install は不要です。
+Python 3.11 以上、`uv`、Node.js 22.22.2（互換の 24.15+/26+ も可）、npm を使います。Repository development は独立 virtual environment を使い、global `proofline` install は不要です。
 
 ```bash
 git clone https://github.com/thangldw/proofline