Update npm dependencies

[cyrossignol]

This is a dependency update that resolves some outstanding security notices. I updated the Nuxt config to account for a couple new features of the dev server:

• Explicitly allow requests referred from a local development domain
• Pre-optimize some modules to avoid full page reloads during development

Changes

Dependencies Updated

• nuxt: ^4.0.0 → ^4.4.6
• vue: ^3.4.19 → ^3.5.34

Nuxt Configuration Enhanced

Added vite configuration to nuxt.config.ts:

• Dev Server: Restricted allowedHosts to workspaces.local to explicitly allow requests from the local development domain.
• Pre-bundling: Configured optimizeDeps.include to pre-bundle key dependencies, reducing full page reloads during development. Included modules: @osmcha/*, @sindresorhus/slugify, Vue devtools packages, @zip.js/zip.js, ajv/ajv-formats, bootstrap-vue-next components/composables, dayjs plugins, maplibre-gl, papaparse, vue-qrcode, and vue3-toastify.

CI Workflow

• Updated GitHub Actions workflow (.github/workflows/ci.yml) to use Node.js 24 instead of 20.

[coderabbitai]

📝 Walkthrough

Walkthrough

Upgrades Nuxt and Vue versions, adds a Vite block in Nuxt config to restrict dev server hosts and pre-bundle listed dependencies, and updates the CI workflow to use Node.js 24.

Changes

Development Environment Setup

Layer / File(s)	Summary
Dependency version upgrades package.json	Nuxt bumped from ^4.0.0 to ^4.4.6 and Vue from ^3.4.19 to ^3.5.34.
Development server and Vite optimization nuxt.config.ts	Adds vite config: server.allowedHosts set to workspaces.local and optimizeDeps.include lists dependencies to pre-bundle during development.
CI Node.js runtime update .github/workflows/ci.yml	CI actions/setup-node now uses node-version: '24'; install (npm ci) and lint steps unchanged.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

A rabbit nibbling on config lines tonight,
Pokes Nuxt and Vue until versions are right,
Vite hums softly, bundling friends in tune,
CI wakes to Node 24 by noon,
Hopping on builds with a tiny 🎩 and light.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Update npm dependencies' directly corresponds to the main changes: Nuxt/Vue version bumps in package.json and related configuration adjustments in nuxt.config.ts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nuxt.config.ts`:
- Around line 60-91: The optimizeDeps block is currently nested under
vite.server; move the optimizeDeps object out of the server section so it
becomes a sibling property directly under vite (i.e., change from
vite.server.optimizeDeps to vite.optimizeDeps) and keep the include array intact
(preserve the listed package entries like '`@osmcha/maplibre-adiff-viewer`',
'ajv', 'dayjs/plugin/relativeTime', etc.) so Vite can recognize the pre-bundling
configuration.

In `@package.json`:
- Line 28: package.json pins "nuxt": "^4.4.6" which requires Node >=22, but the
CI uses Node 20 causing installs to fail; fix by either updating the CI Node
runtime to a compatible major (22, 24, or 26+) in the workflow configuration or
change the "nuxt" dependency in package.json to a version compatible with Node
20 (downgrade "nuxt" to a 3.x/compatible release). Ensure the chosen approach
updates the CI workflow's node-version entry or the "nuxt" version string so
they match and then run CI locally (or npm ci) to verify installation succeeds.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0021313d-fe6e-4dd1-b102-91f21471b434

📥 Commits

Reviewing files that changed from the base of the PR and between 91fc79e and 649d9fc.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• nuxt.config.ts
• package.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 15-18: The workflow uses mutable tags actions/checkout@v4 and
actions/setup-node@v4 which violate the unpinned-uses policy; update both
occurrences to the corresponding immutable commit SHAs (replace
actions/checkout@v4 and actions/setup-node@v4 with their full commit SHA pins)
so the workflow references a specific commit for each action, and verify the SHA
values are the latest recommended SHAs from the official action repositories
before committing.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 89d22712-5d27-45bc-a75e-57546cacd6b6

📥 Commits

Reviewing files that changed from the base of the PR and between 649d9fc and db6cf35.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• nuxt.config.ts
• package.json

[cyrossignol]

Merging—discussed with/approved by @jeffmaki in yesterday's call.