Addressing #1346 from dependabot - updating vite version

[Anton Staykov (astaykov)]

Supersedes #1346 (Dependabot: Vite 7.3.2 → 8.x in /src/report). Please close that PR in favour of this one.

#1346 cannot be merged as-is: the Vite 8 upgrade silently breaks report generation, and nothing in CI would have caught it.

What breaks under Vite 8

Vite 8 replaces esbuild/Rollup with Oxc/Rolldown. The report configs relied on esbuild: { minifyIdentifiers: false, keepNames: true } to preserve the placeholder that Get-HtmlReport splices the assessment JSON into. Vite 8 does not map those options to Oxc and says so at build time:

Both esbuild and oxc options were set. oxc options will be used and esbuild options
will be ignored. The following esbuild options were set: { minifyIdentifiers: false, keepNames: true }

Result, reproduced locally on top of dev:

	Before (Vite 7)	#1346 as-is (Vite 8)
Default template	builds, markers 1/1	builds, but reportData mangled away — 0 occurrences
Classic template	builds, markers 1/1	hard fail — TS2769, esbuild option no longer assignable to ESBuildOptions
End marker	EndOfJson:"EndOfJson"}	EndOfJson:`EndOfJson` — Oxc rewrites quotes to backticks

Two independent breakages. At runtime Invoke-ZtAssessment would have thrown Report template markers were not found in template.

A config-only fix is not possible: Rolldown's CodegenOptions exposes only removeWhitespace and legalComments, so there is no way to force double quotes.

The fix

The placeholder is now injected verbatim into the HTML by a small transformIndexHtml plugin (src/report/vite-plugin-report-data.ts), which keeps it out of the JS bundle and away from the minifier entirely — immune to identifier mangling and quote-style changes, now and on future bundler swaps.

The demo dataset moves to a single shared src/report/demo-report-data.json (it was duplicated verbatim across both source trees) and is still emitted inside the marker span, so Get-HtmlReport replaces it wholesale exactly as before.

The marker strings are unchanged, so no PowerShell changes were required.

Also in scope, all required to get the build green:

• vite.config.ts / vite.config.current.ts: drop the now-ignored esbuild block; rollupOptions → rolldownOptions
• tsconfig.node.json: include the new plugin and the current config
• Both templates rebuilt and committed — Bump vite, @vitejs/plugin-react and vite-plugin-singlefile in /src/report #1346 did not regenerate them

Verification

• Markers 1/1 on both templates; zero external <script src= / <link stylesheet> refs (single-file invariant holds)
• Templates −37%: 2370 → 1495 KB, 2326 → 1460 KB
• Rendered from SampleReport.json through the real Get-HtmlReport: both templates OK, 295 tests, TenantName: Contoso, all pillar routes render, charts render, zero console errors, reports −26%
• Fallback path intact: an un-injected template still renders the bundled demo data
• npm run dev verified
• New-DemoReport.ps1 anonymization check passes with no leaks
• Both templates rebuild byte-identical, so the committed artifacts provably match the sources
• Full Pester suite: 13,973 tests, 0 failures

New regression test

code-tests/commands/ReportTemplate.Markers.Tests.ps1 asserts, for both templates: marker counts, marker ordering, the single-file invariant, and a Get-HtmlReport round trip. It runs inside the existing validate.yml Pester job — no new CI infrastructure.

Confirmed to have teeth: against a deliberately Oxc-mangled template it produces 4 failures, including the real Get-HtmlReport throw. This closes the gap that made the whole exercise necessary — CI green previously said nothing about the report.

Notes for reviewers

• Also obsoletes Bump @babel/core from 7.28.5 to 7.29.7 in /src/report #1327 (@babel/core 7.28.5 → 7.29.7). @vitejs/plugin-react 6 uses Oxc instead of Babel, so @babel/core is gone from the tree entirely — 22 @babel/* packages down to 1, 547 → 490 packages total, npm audit 10 → 5.
• Bump brace-expansion from 5.0.4 to 5.0.7 #1427 (brace-expansion, root lockfile) is unrelated and does not conflict.
• Targets dev rather than main, since that is where the current report sources live.
• Pre-existing issue, not introduced here: the committed ReportTemplate.classic.html on dev was already stale — a clean rebuild was 11 KB smaller than the committed file.
• Follow-up, deliberately out of scope: SampleReport.html at the repo root still embeds the previous template, and the Vite native-config-loader warnings (__dirname, extensionless import) remain.