Pure formatting — no behaviour change. Verified: build passes, all 14
routes render, service worker active, no console errors.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Ve7HLspzeG2xDPtJQ8vmu
Vite 5 pulled esbuild 0.21.5 — the only source of the GHSA-67mh-4wv8-2f99
dev-server advisory. Vite 6.4 (esbuild 0.25) runs on the current Node
baseline and clears it: `npm audit` now reports 0 vulnerabilities.
- vite 5.4 → 6.4, vite-plugin-pwa 0.21 → 1.3 (needs Vite 6+).
- Removed `ws` from devDependencies — it was only used by throwaway test
scripts, never the app or build.
- Build, all 14 routes, and the service worker verified on Vite 6.
- SECURITY.md / AGENTS.md updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Ve7HLspzeG2xDPtJQ8vmu
- .github/workflows/ci.yml — npm ci + npm run build on push/PR, with the
PokéAPI snapshot cached so only the first run pays the fetch cost.
- .github/dependabot.yml — weekly npm, monthly actions, grouped.
- .github/ISSUE_TEMPLATE/ — bug report, feature request, config with
discussion / upstream-data links.
- CODE_OF_CONDUCT.md — Contributor Covenant 2.1 (contact method is a
placeholder to fill in).
- SECURITY.md — private reporting + the known dev-only Vite/esbuild advisory.
- AGENTS.md — machine-facing version of CONTRIBUTING for AI coding agents.
- docs/screenshots/ + a strip in the README (resized + pngquant'd, ~240 KB).
- public/og.png + Open Graph / Twitter card meta in index.html.
- .nvmrc (20); gitignore .claude/ .idea/ .vscode/.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Ve7HLspzeG2xDPtJQ8vmu
