chore: bump vite, esbuild, rolldown, dompurify, and other UI dependencies

[impoiler]

Summary

Bumps several frontend dependencies to their latest versions and adds the @date-fns/tz package for timezone-aware date handling.

Changes

• Added @date-fns/tz 1.5.0 as a new dependency
• Upgraded vite from 8.0.7 to 8.0.16
• Upgraded dompurify override from 3.4.0 to 3.4.10
• Upgraded rolldown from 1.0.0-rc.13 to 1.0.3 (stable release)
• Upgraded esbuild from 0.28.0 to 0.28.1
• Upgraded form-data from 4.0.5 to 4.0.6
• Upgraded hasown from 2.0.3 to 2.0.4
• Upgraded tinyglobby from 0.2.16 to 0.2.17
• Upgraded @oxc-project/types from 0.123.0 to 0.133.0
• Upgraded @emnapi/* packages to their latest patch versions

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

Breaking changes

• Yes
• No

Security considerations

The dompurify upgrade from 3.4.0 to 3.4.10 may include security patches and should be reviewed against the DOMPurify changelog for any relevant CVE fixes.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Warning

Review limit reached

@impoiler, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 5 minutes and 12 seconds. Learn how PR review limits work.

To continue reviewing without waiting, enable usage-based billing in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ff165482-a4c0-4c90-a654-7959de0875c6

📥 Commits

Reviewing files that changed from the base of the PR and between efb3ba1 and 8f7af65.

⛔ Files ignored due to path filters (1)

• ui/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• ui/package.json

📝 Walkthrough

Walkthrough

The overrides pin for dompurify in ui/package.json is bumped from version 3.4.9 to 3.4.10.

Changes

DOMPurify Override Bump

Layer / File(s)	Summary
DOMPurify override pin ui/package.json	Updates the dompurify version in the overrides field from 3.4.9 to 3.4.10.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~1 minutes

Possibly related PRs

• maximhq/bifrost#4441: Also modifies the overrides.dompurify version in ui/package.json, bumping it from 3.4.0 to 3.4.9 — the direct predecessor to this version bump.

Suggested reviewers

• danpiths

Poem

A tiny hop, a version leaps,
From .9 to .10 while the rabbit sleeps. 🐇
DOMPurify scrubs the HTML clean,
The freshest patch the UI has seen.
One line changed, the diff is slim —
Security updated on a whim! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: bumping multiple UI dependencies including vite, esbuild, rolldown, dompurify, and others.
Description check	✅ Passed	The description is comprehensive and follows the template structure with all major sections completed: summary, changes, type of change, affected areas, how to test, breaking changes, security considerations, and checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 06-16-chore_ui_dependency_updates_for_npn_audit

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[impoiler]

• feat: show inline error for 409 errors #4546
• fix: return 409 on unique constraint violations for virtual keys, teams, customers, and MCP clients #4539
• feat: add attribution columns (virtual key, routing rule, team, customer, user, business unit) to logs table with localStorage persistence #4521
• fix: show remaining minutes and seconds in secondsToHumanReadable #4464
• feat: add consolidated GET /api/logs/dashboard endpoint #4450
• fix: standardize pagination UI and fix scrolling layout across table views #4433
• fix: remove effect that cleared selected IDs on visibility change #4428
• feat: add virtual key rankings dimension to dashboard #4427
• chore: bump vite, esbuild, rolldown, dompurify, and other UI dependencies #4426 👈 (View in Graphite)
• feat: add timezone selector to date range picker with localStorage persistence #4422
• feat: overhaul skills repo UI with resizable panels, file-aware markdown links, breadcrumb nav, and version popover #4487
• fix: handle url encoded file name in url params for single file serving endpoint #4495
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — the only runtime-code change is a patch-level dompurify security bump and the addition of the well-maintained @date-fns/tz package; no logic changes.

The diff is limited to a dompurify override patch bump (3.4.9 → 3.4.10) and registering @date-fns/tz 1.5.0 in the lockfile. Both are low-risk, routine dependency updates with no behavioral changes to application code.

No files require special attention.

Important Files Changed

Filename	Overview
ui/package.json	Adds @date-fns/tz 1.5.0 as a runtime dependency and bumps the dompurify override from 3.4.9 to 3.4.10; all other listed upgrades originate from the base branch.
ui/package-lock.json	Lockfile regenerated to record @date-fns/tz and the dompurify 3.4.9 → 3.4.10 bump; no integrity or resolution anomalies visible.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[ui/package.json] -->|dompurify 3.4.9 to 3.4.10| B[Security patch applied]
    A -->|date-fns/tz 1.5.0 added| C[Timezone-aware date handling]
    C --> D[date-fns 4.1.0 existing dep]
    C --> E[IANA timezone support for date selectors]
    A -->|vite esbuild rolldown from base branch| F[Build tool upgrades in lockfile]
    B --> G[ui/package-lock.json regenerated]
    C --> G
    F --> G

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[ui/package.json] -->|dompurify 3.4.9 to 3.4.10| B[Security patch applied]
    A -->|date-fns/tz 1.5.0 added| C[Timezone-aware date handling]
    C --> D[date-fns 4.1.0 existing dep]
    C --> E[IANA timezone support for date selectors]
    A -->|vite esbuild rolldown from base branch| F[Build tool upgrades in lockfile]
    B --> G[ui/package-lock.json regenerated]
    C --> G
    F --> G

Loading

_{Reviews (7): Last reviewed commit: "chore: UI dependency updates for npn aud..." | Re-trigger Greptile}

[akshaydeo]

Merge activity

• Jun 19, 6:55 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 19, 6:58 AM UTC: @akshaydeo merged this pull request with Graphite.

The base branch was changed.