[ConsoleTVs]

Summary

dev/CI → Node 26 + matching typings
build → Vite 8.3.5 + current React/declaration plugins
checks → Vitest/coverage 5.0.5 + Happy DOM 21.0.4 + latest Oxc tools
React test runtime → 19.3.1

Update every direct dev dependency with a compatible stable upgrade, plus patched transitive dependencies. The React compiler is already current. Retain TypeScript 6.0.3: the TypeScript 7 trial required a JS-API fallback and left Volar peers invalid; no force flags or overrides are used.

Use object refs and JSX in the prefetch test helper for the newer React lint rules. Library runtime sources, consumer Node engine (>=18), and optional React peers (^19.2.0) are unchanged. Update repository skill guidance with toolchain compatibility and validation requirements.

Evidence

• Before: Stale tooling, multiple security advisories, Node 25 excluded by Vitest 5.
  After: Clean npm ci and npm ls --all; npm audit reports 0 vulnerabilities. npm outdated lists only the intentional TypeScript hold.
• Validated with Node 26.12.1: 279 tests pass, including coverage; production typecheck covers 36 source files; 33 extracted documentation examples typecheck.
• Formatting passes. Lint passes with one warning about existing effect dependencies; dependencies retained to avoid altering runtime behavior.
• Production build and package generation complete. Packed ESM/CommonJS entry points, declarations, matcher, SSR, and initial guards pass consumer smoke tests on Node 26 and on Node 18.20.8 with React 19.2.0.
• Full-project checking retains the four baseline setup/context-nullability errors; declaration generation still reports the existing setup typing diagnostic. Vite also warns about future native-config import extension requirements. These are reported, not hidden.

Merge Danger

Door: two-way

Blast Radius: tooling

Contributors/CI now require Node >=26; .nvmrc selects 26. Consumer requirements and runtime API are unchanged. Major test-environment/tooling upgrades are covered by tests and package smoke checks. TypeScript 7 is deliberately deferred until declaration tooling has a valid compatible peer graph.