chore: dependency management

[alexluckett]

Dependency management

Removed (unused)

• @hapi/catbox — not imported anywhere; uses @hapi/catbox-memory/@hapi/catbox-redis directly
• @hapi/jwt — not imported in source files
• accessible-autocomplete — not referenced in source files or webpack config
• atob, btoa — not imported anywhere
• date-fns — not imported anywhere
• highlight.js — not imported anywhere
• liquidjs — not imported anywhere
• lodash — not imported anywhere
• marked — not imported anywhere
• semver — not imported anywhere
• @types/atob, @types/btoa, @types/eslint, @types/hapi, @types/hapi__catbox-memory, @types/hapi__cookie, @types/hapi__yar, @types/hoek, @types/lodash, @types/mysql, @types/url-parse, @types/webpack-assets-manifest, @types/wreck — types for removed or unused packages
• babel-plugin-transform-import-meta — not in babel.config.cjs; was re-added after test failure revealed it's used via string reference in jest.config.mjs (plugins: ['transform-import-meta'])
• core-js — not imported anywhere
• outdent — not imported anywhere

Also:

• Added .worktrees/** to ESLint global ignores (pre-existing local lint failure caused by active git worktree)
• Fixed pre-existing prettier formatting issue in docs/superpowers/plans/

Updated (minor/patch)

• @aws-sdk/client-sns: ^3.997.0 → ^3.1062.0
• @defra/forms-model: ^3.0.674 → ^3.0.675
• @hapi/hapi: ^21.4.4 → ^21.4.9
• @hapi/inert: ^7.1.0 → ^7.1.1
• @hapi/wreck: ^18.1.0 → ^18.1.2
• dotenv: ^17.2.4 → ^17.4.2
• ioredis: ^5.9.2 → ^5.11.1
• pino: ^10.2.1 → ^10.3.1 (no breaking changes at this minor)
• resolve: ^1.22.11 → ^1.22.12
• @babel/cli, @babel/core, @babel/plugin-syntax-import-attributes, @babel/preset-env, @babel/preset-typescript: ^7.28.x → ^7.29.7
• @types/node: ^25.2.2 → ^25.9.1
• autoprefixer: ^10.4.23 → ^10.5.0
• babel-loader: ^10.0.0 → ^10.1.1
• babel-plugin-module-resolver: ^5.0.2 → ^5.0.3
• eslint-plugin-jest: ^29.12.1 → ^29.15.2
• globals: ^17.3.0 → ^17.6.0
• jest: ^30.2.0 → ^30.4.2
• postcss: ^8.5.6 → ^8.5.15
• postcss-loader: ^8.2.0 → ^8.2.1
• prettier: ^3.7.4 → ^3.8.3
• sass-embedded: ^1.97.2 → ^1.100.0
• terser-webpack-plugin: ^5.3.16 → ^5.6.1
• tsx: ^4.21.0 → ^4.22.4
• webpack: ^5.104.1 → ^5.107.2
• webpack-assets-manifest: ^6.5.0 → ^6.5.2
• neostandard: pinned at 0.12.2 (0.13.0 breaks eslint via import-x)
• typescript-eslint: pinned at 8.56.1 (8.60.1 introduces no-unsafe-* warnings)

One code fix required: @defra/forms-model ^3.0.675 narrowed the FormStatus type; added /** @type {FormStatus | undefined} */ cast in src/server/routes/save-and-exit.js:206.

Major updates — applied in this PR

• @hapi/scooter: v7 → v8 — no code changes required
• @types/jsdom: v21 → v28 — no code changes required
• concurrently: v9 → v10 — no code changes required
• copy-webpack-plugin: v13 → v14 — no code changes required
• cssnano: v7 → v8 — no code changes required
• cssnano-preset-default: v7 → v8 — no code changes required
• eslint: v9 → v10 — no code changes required (flat config + typescript-eslint pinned at 8.56.1)
• eslint-plugin-jsdoc: v62 → v63 — no code changes required
• lint-staged: v16 → v17 — no code changes required
• sass-loader: v16 → v17 — no code changes required
• stylelint: v16 → v17 — no code changes required
• stylelint-config-gds: v2 → v3 — no code changes required
• webpack-cli: v6 → v7 — no code changes required

Major updates — deferred

• govuk-frontend: v5 → v6 — major GDS frontend framework upgrade, likely involves template/component API changes across many views
• joi: v17 → v18 — @defra/forms-engine-plugin bundles its own joi internally; mixing versions causes "Cannot mix different versions of joi schemas"
• proxy-agent: v6 → v8 — ESM-only package
• chokidar: v3 → v5 — peer conflict with nunjucks@3 and widespread test failures (24+ suites)
• jsdom / global-jsdom: v26 → v29 — widespread test failures (18+ suites)
• typescript: v5 → v6 — deferred across all repos

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud