chore(deps): refresh supported JavaScript dependency updates

[justin808]

Summary

• Consolidate the supported pending JS Dependabot updates into one refresh branch
• Regenerate the checked-in React and UJS build artifacts so check_react_and_ujs stays green
• Carry the dummy app and react-builds lockfiles forward to the latest compatible webpack 5 patch release

Supersedes

• chore(deps): bump svgo from 3.0.2 to 3.3.3 #1392, chore(deps): bump minimatch from 3.0.8 to 3.1.5 in /test/dummy #1390, chore(deps): bump pbkdf2 from 3.1.2 to 3.1.5 in /react-builds #1386, chore(deps): bump webpack from 5.76.3 to 5.104.1 in /test/dummy #1384, chore(deps): bump qs from 6.11.2 to 6.14.2 in /react-builds #1383, chore(deps): bump webpack from 5.85.0 to 5.104.1 in /react-builds #1382, chore(deps-dev): bump webpack from 5.83.1 to 5.104.1 #1381, chore(deps): bump brace-expansion from 1.1.11 to 1.1.12 in /test/dummy #1375, chore(deps): bump node-forge from 1.3.1 to 1.3.3 in /test/dummy #1374, chore(deps): bump postcss from 8.4.25 to 8.5.6 #1373, chore(deps): bump js-yaml from 4.1.0 to 4.1.1 in /test/dummy #1372, chore(deps): bump nanoid from 3.3.6 to 3.3.11 #1371, chore(deps): bump serialize-javascript from 6.0.1 to 6.0.2 #1370

Validation

• mise x ruby@2.7.8 node@20.19.0 -- bundle _2.4.9_ exec rake test
• env PACKAGE_JSON_FALLBACK_MANAGER=yarn_classic mise x ruby@2.7.8 node@20.19.0 -- bundle _2.4.9_ exec rake test

[claude]

Code Review: chore(deps): refresh supported JavaScript dependency updates

Summary

This PR consolidates ~13 pending Dependabot JS updates into a single branch and regenerates the checked-in build artifacts. The approach is sound, but there is a blocking CI failure that needs to be addressed before merging.

---

Blocking Issue: check_react_and_ujs CI failure

The check_react_and_ujs (2.7) check is failing, and because test and test_connection_pool_v3 both depend on it, all downstream tests were skipped.

The job runs:

1. bundle exec rake react:update
2. bundle exec rake ujs:update
3. ./check_for_uncommitted_files.sh

The failure means the checked-in artifacts (lib/assets/react-source/, lib/assets/javascripts/react_ujs.js, react_ujs/dist/react_ujs.js) do not match what those rake tasks produce in CI. The PR description lists regenerating these artifacts as a goal, so this must be resolved before landing.

Likely cause: artifacts were built locally with a slightly different Node.js version, yarn cache state, or webpack configuration than the CI runner. Re-running the rake tasks in a clean environment (Node 20.19.0 as documented) and re-committing the outputs should fix this.

---

Code Quality and Best Practices

• Consolidation approach is correct — batching Dependabot updates into one refresh branch avoids a cascade of artifact-regeneration PRs.
• Lockfile hygiene looks fine. All three lockfiles (yarn.lock, react-builds/yarn.lock, test/dummy/yarn.lock) are updated together as expected.
• react_ujs/dist/react_ujs.js and lib/assets/javascripts/react_ujs.js are identical after this PR, consistent with the ujs:copy rake task.

---

Potential Bugs / Issues

• webpack module IDs changed in the UJS bundle (e.g. __WEBPACK_EXTERNAL_MODULE__787__ to __WEBPACK_EXTERNAL_MODULE__442__). This is expected when webpack 5 reassigns chunk IDs after a dependency graph change, but worth confirming no source logic changed unintentionally.
• Minified production React files (lib/assets/react-source/production/react.js, react-server.js) show +1/-1 each — impossible to review manually. The CI artifact-equivalence check is the only real validation, and it is currently red.

---

Security

The eval() calls in lib/assets/react-source/development/react-server.js are webpack's devtool: 'eval' source-map strategy. They pre-date this PR, are scoped to the development bundle only, and are not shipped in the production asset. No new security surface is introduced.

Updated packages are transitive build/tooling dependencies (webpack 5.105.4, terser-webpack-plugin, etc.) — not runtime dependencies exposed to end users via the gem.

---

Test Coverage

No new tests are needed for pure lockfile/artifact updates. The existing check_react_and_ujs + full test matrix is the correct validation. Once CI is green, this will be adequately validated.

---

Action Required

1. Fix the check_react_and_ujs failure by regenerating artifacts in a clean environment matching CI (Node 20.19.0), then re-push.
2. Confirm test and test_connection_pool_v3 pass after the fix.