[bpamiri]

Summary

This refreshes two npm lockfiles and removes one dev dependency nothing uses.

• package-lock.json (repo root, dev tooling only: commitlint, husky, tsx, Playwright test, the issue-resolver scripts). Re-resolved within its existing package.json ranges (npm update --package-lock-only). The manifest is unchanged.
• tools/docker/testui/ (the TestUI Vue app):
  • The lock is re-resolved within its ranges.
  • The puppeteer devDependency is dropped. It was unused: nothing in the app's source, its package.json scripts, the Dockerfiles or shell scripts, .github/workflows, tools/ or any test-runner config references it. The only other repo hits are a Puppeteer MCP server's tool names in examples/tweet/, which is unrelated to the npm package.
  • Because the Dockerfiles run npm install, removing it also takes the Chrome download out of the Docker build stage.
  • The lock goes from 183 to 86 installed packages.
  • The image's final stage is nginx serving dist/, so node_modules never shipped either way.

This is the non-web/ counterpart of #4362's lock refresh.

Verification

• Root: npm ci --ignore-scripts passes, and commitlint accepts a valid header and rejects an invalid one.
• TestUI: npm ci --ignore-scripts and npm run build (vite) pass.
• npm run type-check in TestUI reports the same PreflightStatus.vue parse errors with develop's lock as with this one. That is pre-existing, not touched here, and not run in CI.

🤖 Generated with Claude Code

[bpamiri]

rev1-r3 review @ 69aa03a: approve in substance (final sign-off after PR CI)

• Direct dependencies stay in range. I diffed each lockfile's top-level resolutions against develop.
  • Root: dotenv 17.4.1→17.4.2, @playwright/test 1.58.2→1.63.0, @types/node 25.5.0→25.9.9, tsx 4.22.4→4.23.15. All are within the package.json ranges, which are unchanged.
  • TestUI: vite 8.0.16→8.3.2, vue 3.5.13→3.5.43, vue-router 4.5.1→4.6.4, pinia, @vitejs/plugin-vue, vue-tsc and typescript 5.8.3→5.9.3 are all minor or patch bumps.
• Dropping puppeteer is safe. Nothing under tools/ or .github/ references it outside the lockfiles, on develop or here, and removing it is most of the TestUI lock shrinking by about 1,300 lines.
• One transitive major to know about: root typescript 6.0.2 → 7.0.2. It isn't a direct dependency. It's hoisted as the peer of cosmiconfig-typescript-loader (>=5) and cosmiconfig (>=4.9.5), which commitlint pulls in, and those open-ended peer ranges let the refresh take the new major. Your commitlint run passing, plus commitlint.config.js being JavaScript (so the TypeScript loader isn't used to load it), make this low risk today. Still, if anything in the root tooling ever loads a .ts config or the TypeScript API, the 7.x line is the first thing to suspect. A root overrides: { "typescript": "^6" } would keep the refresh "in range" in spirit as well as letter. Your call; not blocking.
• The TestUI type-check errors are the same with develop's lockfile, so they predate this PR.

[bpamiri]

rev1-r3 review @ 69aa03a: APPROVE (final; PR CI checked)

PR CI on this head: 12 pass, 3 skipped, 0 failing or pending. That includes Validate Commit Messages, which runs commitlint under the refreshed root lock (so with TypeScript 7.0.2 hoisted, as noted), plus the CLI, LuCLI, RustCFML and engine smoke jobs. No PR job builds the TestUI; your local npm ci plus the vite build cover that lock.