[david-crespo]

npm audit fix

The first commit clears everything npm audit reported, all of it in dev tooling or the mock API. Two things went beyond a plain npm audit fix:

• vitest and @vitest/browser-playwright are bumped to 5.1.0 in package.json. The vitest packages pin each other as exact peer dependencies, so npm couldn't update them in place and they had to be reinstalled together.
• The lockfile entry for proxy-addr said 2.0.7 but had the tarball URL and integrity hash of 2.0.8, so the fixed version was already installed and only the version field was wrong.

Our own Playwright lint rule

One of the audit findings was in eslint, which we never run: eslint-plugin-playwright requires it as a peer dependency. The plugin is maintained, but we only used one rule from it, expect-expect, which is about 30 lines of logic upstream. The second commit replaces it with a local oxlint plugin in tools/oxlint-plugin-playwright.ts, which lets us drop eslint entirely: 66 packages and about 850 lines come out of the lockfile.

To check it's as good as before, I ran the old and new rule over test/e2e and they flagged the same tests: none, plus the five in disks.e2e.ts that were behind a disable comment. We also checked with temporary specs that a test with no assertions is flagged and that tests using only expect.poll or a helper like expectRowVisible are not.

It's better than before in a few ways, and easy to keep customizing:

• Assertions in beforeEach/afterEach count, so the disable comment in disks.e2e.ts is gone.
• Any call starting with expect counts as an assertion, so we no longer keep a list of helper names in .oxlintrc.json.
• The rule is an error now. It was a warning, which didn't fail lint.
• Two new rules for conventions we already had: no-focused-test (test.only) and no-page-route (use a sentinel in the mock API, not page.route).

A comment in the plugin lists four more rules we plan to add once existing violations are cleaned up. This PR also deletes 13 disable comments for playwright rules that were never enabled.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
console	Ready	Preview	Nov 11, 2026 7:53pm UTC

[david-crespo]

I have a robot looking for any other huge dependencies we could eliminate entirely by writing 30 lines of code.