chore(ai): dependency scan and upgrade analysis

Co-authored-by: PR0M3TH3AN <[email protected]>

issues/upgrade-cross-env.md

@@ -1,7 +1,17 @@
 # Upgrade cross-env
 
-- **Current Version:** 7.0.3
-- **Latest Version:** 10.1.0
+## Status
+- **Current:** `7.0.3`
+- **Latest:** `10.1.0`
 
-**Status:** Major Upgrade Required
-**Reason:** Major version bump available. v10 requires Node >= 20, which may break CI/CD or local environments running older Node versions (e.g. Node 18). Requires explicit environment verification and separate PR.
+## Details
+Major version upgrade.
+Used in npm scripts to set environment variables.
+
+## Plan
+1. Update `cross-env`.
+2. Check if node version requirements changed (v10+ required likely).
+3. Run all npm scripts to verify `cross-env` invocations work.
+
+## Guardrails
+- Major upgrade.

issues/upgrade-esbuild.md

@@ -1,7 +1,17 @@
 # Upgrade esbuild
 
-- **Current Version:** 0.25.12
-- **Latest Version:** 0.27.2
+## Status
+- **Current:** `0.25.12`
+- **Latest:** `0.27.2`
 
-**Status:** Major Upgrade Required
-**Reason:** 0.x version bump may contain breaking changes. Requires strict testing and separate PR.
+## Details
+`esbuild` 0.x versions may have breaking changes between minor versions.
+Used for build scripts (`scripts/build-dist.mjs`, `scripts/build-beacon.mjs`).
+
+## Plan
+1. Update `esbuild`.
+2. Run build scripts: `npm run build`, `npm run build:beacon`.
+3. Verify output bundles work correctly.
+
+## Guardrails
+- Build tool upgrade.

issues/upgrade-nostr-tools.md

@@ -1,8 +1,21 @@
 # Upgrade nostr-tools
 
-- **Current Version:** 2.19.4
-- **Wanted Version:** 2.20.0
-- **Latest Version:** 2.20.0
+## Status
+- **Current (Package):** `^2.19.4`
+- **Current (Vendor):** `2.17.0` (found in `vendor/nostr-tools.bundle.min.js`)
+- **Latest:** `2.21.0`
 
-**Status:** Skipped (Risky/Protocol)
-**Reason:** This is a cryptographic/protocol library. As per security guardrails, manual review is required before upgrading.
+## Details
+`nostr-tools` is a core protocol library.
+There is a discrepancy between `package.json` (2.19.4) and the vendored bundle (2.17.0).
+The latest version 2.21.0 is available.
+
+## Plan
+1. Review changelogs for breaking changes between 2.17.0/2.19.4 and 2.21.0.
+2. Update `package.json` to `2.21.0`.
+3. Update `vendor/nostr-tools.bundle.min.js` to match the new version.
+4. Verify `js/nostr/client.js` and other consumers work correctly.
+5. Run full E2E and Unit tests.
+
+## Guardrails
+- Protocol library: Requires manual review.

issues/upgrade-pixelmatch.md

@@ -1,7 +1,17 @@
 # Upgrade pixelmatch
 
-- **Current Version:** 5.3.0
-- **Latest Version:** 7.1.0
+## Status
+- **Current:** `5.3.0`
+- **Latest:** `7.1.0`
 
-**Status:** Major Upgrade Required
-**Reason:** Major version bump available. Requires strict testing and separate PR.
+## Details
+Major version upgrade.
+Used in visual tests.
+
+## Plan
+1. Update `pixelmatch`.
+2. Run `npm run test:visual`.
+3. Check if image comparison logic needs adjustment (sensitivity, anti-aliasing handling).
+
+## Guardrails
+- Major upgrade.

issues/upgrade-prettier-plugin-tailwindcss.md

@@ -1,7 +1,17 @@
 # Upgrade prettier-plugin-tailwindcss
 
-- **Current Version:** 0.6.14
-- **Latest Version:** 0.7.2
+## Status
+- **Current:** `0.6.14`
+- **Latest:** `0.7.2`
 
-**Status:** Major Upgrade Required
-**Reason:** 0.x version bump may contain breaking changes. Requires strict testing and separate PR.
+## Details
+0.x minor version upgrade, potential breaking changes.
+Depends on `prettier` and `tailwindcss` versions.
+
+## Plan
+1. Update `prettier-plugin-tailwindcss`.
+2. Run `npm run format`.
+3. Check for formatting changes.
+
+## Guardrails
+- Dev tool upgrade.

issues/upgrade-stylelint.md

@@ -1,7 +1,17 @@
 # Upgrade stylelint
 
-- **Current Version:** 16.26.1
-- **Latest Version:** 17.0.0
+## Status
+- **Current:** `16.26.1`
+- **Latest:** `17.0.0`
 
-**Status:** Major Upgrade Required
-**Reason:** Major version bump available. Requires strict testing and separate PR.
+## Details
+Major version upgrade.
+May require updating rules in `stylelint.config.cjs`.
+
+## Plan
+1. Update `stylelint`.
+2. Run `npm run lint:css` to identify config errors or new violations.
+3. Fix config/violations.
+
+## Guardrails
+- Major upgrade.

issues/upgrade-tailwindcss.md

@@ -1,7 +1,19 @@
 # Upgrade tailwindcss
 
-- **Current Version:** 3.4.19
-- **Latest Version:** 4.1.18
+## Status
+- **Current:** `3.4.19`
+- **Latest:** `4.1.18`
 
-**Status:** Major Upgrade Required
-**Reason:** Major version bump available (v4). Requires strict testing, migration guide adherence, and separate PR.
+## Details
+Major version upgrade from v3 to v4.
+This likely includes breaking changes in configuration, class names, or build process.
+
+## Plan
+1. Review Tailwind CSS v4 migration guide.
+2. Update `tailwindcss`, `postcss`, `autoprefixer`.
+3. Check `tailwind.config.cjs` compatibility.
+4. Run `npm run build:css` and verify output.
+5. Visual regression testing (`npm run test:visual`).
+
+## Guardrails
+- Major upgrade: Requires separate PR and thorough testing.

issues/upgrade-webtorrent.md

@@ -0,0 +1,19 @@
+# Upgrade webtorrent
+
+## Status
+- **Current:** `2.5.11` (vendored in `js/webtorrent.min.js`)
+- **Latest:** `2.8.5`
+
+## Details
+`webtorrent` is a core protocol library for video playback.
+The current version is vendored and outdated.
+
+## Plan
+1. Review changelogs for breaking changes between 2.5.11 and 2.8.5.
+2. Download new release or build from source.
+3. Replace `js/webtorrent.min.js`.
+4. Verify playback and fallbacks.
+5. Smoke test Upload Modal and Magnet parsing.
+
+## Guardrails
+- Protocol library: Requires manual review.