chore: upgrade npm deps — vite 8, prettier plugins, @types/node, @eslint/compat

Upgrades applied:
  @types/node: 22.20.1 → 26.1.1
  @eslint/compat: 1.4.1 → 2.1.0
  prettier-plugin-tailwindcss: 0.7.4 → 0.8.0
  prettier-plugin-svelte: 3.5.2 → 4.1.1 (formatted textarea.svelte)
  vite: 7.3.6 → 8.1.4
  @sveltejs/vite-plugin-svelte: 6.2.4 → 7.2.0

Left at current (blocked by deps chain):
  eslint / @eslint/js — typescript-eslint needs eslint 10 support
  typescript — typescript-eslint needs TS 7 support

Added CI TODO note for when vite-plugin-svelte-inspector catches up.

.gitea/workflows/ci.yaml

@@ -703,6 +703,9 @@ jobs:
             if (major.length) {
               console.log('Major (out-of-range) updates available — review carefully:');
               major.forEach(([k, v]) => console.log('  ' + k + ': ' + v.current + ' (wanted: ' + v.wanted + ') -> latest: ' + v.latest));
+              // TODO: vite 8 + svelte-vite 7 now install clean via npm ci.
+              // Remove --legacy-peer-deps from local npm install workflow once
+              // @sveltejs/vite-plugin-svelte-inspector catches up.
               process.exit(1);
             } else {
               console.log('All dependencies within semver range, no major updates');

frontend/package.json

@@ -18,16 +18,16 @@
 		"lint:a11y": "eslint 'src/**/*.svelte' --config eslint.a11y.config.js"
 	},
 	"devDependencies": {
-		"@eslint/compat": "^1.2.5",
+		"@eslint/compat": "^2.1.0",
 		"@eslint/js": "^9.22.0",
 		"@internationalized/date": "^3.11.0",
 		"@lucide/svelte": "^1.17.0",
 		"@sveltejs/adapter-static": "^3.0.9",
 		"@sveltejs/kit": "^2.22.0",
-		"@sveltejs/vite-plugin-svelte": "^6.2.4",
+		"@sveltejs/vite-plugin-svelte": "^7.2.0",
 		"@tailwindcss/vite": "^4.2.0",
 		"@types/geojson": "^7946.0.16",
-		"@types/node": "^22.19.11",
+		"@types/node": "^26.1.1",
 		"bits-ui": "^2.16.1",
 		"clsx": "^2.1.1",
 		"eslint": "^9.22.0",
@@ -36,8 +36,8 @@
 		"globals": "^17.3.0",
 		"mode-watcher": "^1.1.0",
 		"prettier": "^3.8.1",
-		"prettier-plugin-svelte": "^3.5.0",
-		"prettier-plugin-tailwindcss": "^0.7.2",
+		"prettier-plugin-svelte": "^4.1.1",
+		"prettier-plugin-tailwindcss": "^0.8.0",
 		"shadcn-svelte": "^1.1.1",
 		"svelte": "^5.0.0",
 		"svelte-check": "^4.4.3",
@@ -49,16 +49,16 @@
 		"tw-animate-css": "^1.4.0",
 		"typescript": "^5.9.3",
 		"typescript-eslint": "^8.20.0",
-		"vite": "^7.0.4"
+		"vite": "^8.1.4"
 	},
 	"dependencies": {
 		"@discourse/jxl": "^1.3.0",
 		"@jsquash/avif": "^2.1.1",
 		"@jsquash/jpeg": "^1.6.0",
 		"@jsquash/webp": "^1.5.0",
-		"@zxcvbn-ts/core": "^3.0.4",
-		"@zxcvbn-ts/language-common": "^3.0.4",
-		"@zxcvbn-ts/language-en": "^3.0.2",
+		"@zxcvbn-ts/core": "^4.1.2",
+		"@zxcvbn-ts/language-common": "^4.1.2",
+		"@zxcvbn-ts/language-en": "^4.1.1",
 		"heic2any": "^0.0.4",
 		"maplibre-gl": "^5.24.0"
 	}

frontend/src/lib/components/ui/textarea/textarea.svelte

@@ -19,5 +19,4 @@
 		className
 	)}
 	bind:value
-	{...restProps}
-></textarea>
+	{...restProps}></textarea>

frontend/src/routes/account/+page.svelte

@@ -11,12 +11,12 @@
 	import { savedCardsStore, type SavedCard } from '$lib/stores/savedCards.svelte';
 
 	// zxcvbn-ts imports
-	import { zxcvbn, zxcvbnOptions } from '@zxcvbn-ts/core';
+	import { ZxcvbnFactory } from '@zxcvbn-ts/core';
 	import * as languageCommon from '@zxcvbn-ts/language-common';
 	import * as languageEn from '@zxcvbn-ts/language-en';
 
 	// set up options so that feedback, dictionary etc. are included
-	zxcvbnOptions.setOptions({
+	const zxcvbn = new ZxcvbnFactory({
 		translations: languageEn.translations,
 		graphs: languageCommon.adjacencyGraphs,
 		dictionary: {
@@ -1111,7 +1111,7 @@
 	let changingPassword = $state(false);
 
 	// Password strength using zxcvbn
-	const newPasswordStrength = $derived(passwordData.new ? zxcvbn(passwordData.new) : null);
+	const newPasswordStrength = $derived(passwordData.new ? zxcvbn.check(passwordData.new) : null);
 	const isPasswordStrongEnough = $derived(
 		!passwordData.new || newPasswordStrength === null || newPasswordStrength.score >= 2
 	);

frontend/src/routes/login/+page.svelte

@@ -11,14 +11,14 @@
 	import { SvelteDate } from 'svelte/reactivity';
 
 	// zxcvbn-ts imports
-	import { zxcvbn, zxcvbnOptions } from '@zxcvbn-ts/core';
+	import { ZxcvbnFactory } from '@zxcvbn-ts/core';
 	import * as languageCommon from '@zxcvbn-ts/language-common';
 	import * as languageEn from '@zxcvbn-ts/language-en';
 	import { toast } from 'svelte-sonner';
 	import { sanitizeText } from '$lib/utils/toast-safe';
 
 	// set up options so that feedback, dictionary etc. are included
-	zxcvbnOptions.setOptions({
+	const zxcvbn = new ZxcvbnFactory({
 		translations: languageEn.translations,
 		graphs: languageCommon.adjacencyGraphs,
 		dictionary: {
@@ -229,7 +229,7 @@
 	const passwordStrength = $derived(
 		formData.password
 			? (() => {
-					const result = zxcvbn(formData.password);
+					const result = zxcvbn.check(formData.password);
 					// Add minimum length check (6 chars) to the score feedback
 					if (formData.password.length < 6) {
 						return {