chore(deps): upgrade phase 1 — in-range bumps, Node 24 LTS, zero phantom deps

.nvmrc

@@ -1 +1 @@
-22.19.0
+24.21.0

CHANGELOG.md

@@ -4,6 +4,14 @@
 
 ## [未发布] - 2026-09 治理批次（feat/next-umi）
 
+### 依赖升级阶段 1（2026-09-23）
+
+- 工具链切到 Node 24 LTS（`.nvmrc` 24.21.0、Docker 构建镜像同步）；engines 由 `>=20`（Node 20 已于 2026-04 停止维护）收紧为 `^22.22.2 || >=24.15.0`，与 Cesium、jsdom 的引擎要求对齐
+- 范围内升级：antd 5.17 → 5.29、cesium 1.141 → 1.145、wavesurfer.js 7.12、xgplayer 3.0.26、FullCalendar 6.1.21、react-pdf 10.5、prettier 3.9 等；@umijs/max 暂留 4.7.19（4.7.20 发布不足两天）
+- 幽灵依赖清零：classnames、@dnd-kit/utilities、pdfjs-dist（与 react-pdf 内置版本严格一致）显式声明；styled-components 改走 `@umijs/max` 再导出，ProCard 改从 pro-components 导入，fecha 换成 dayjs。仓库卫生门禁新增「导入包必须已声明」与 pdfjs 版本一致性检查，为后续 pnpm 11（不再读取 `.npmrc` 的 shamefully-hoist）铺路
+- antd 5.25 起废弃的 `destroyOnClose` 改为 `destroyOnHidden`；vendor-antd 分包覆盖 `@rc-component/*` 作用域
+- 依赖审计 low 3 → 1（postcss-selector-parser 两条经 override 修复）
+
 ### 审查修复（2026-09-21 审查后）
 
 - 本地开发恢复：`mock/` 下的测试文件导致 umi mock 整批加载失败（dev 全站 HTTP 500、preview 启动即退出），测试移出并加 mock 可加载性门禁

CONTRIBUTING.md

@@ -4,7 +4,7 @@
 
 ## 环境准备
 
-- Node.js 22（见 `.nvmrc`，推荐 nvm）
+- Node.js 24 LTS（见 `.nvmrc`，推荐 nvm / fnm）；最低 22.22.2
 - pnpm 10+（`packageManager` 字段钉住版本，corepack 可自动启用）
 
 ```bash

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # ---------- 阶段一：构建 ----------
-FROM node:22-alpine@sha256:b6f26b36c8ff49624cfdac716b8ea1138d606df02586a77d364bb5536a634f85 AS builder
+FROM node:24-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS builder
 WORKDIR /app
 
 # 先装依赖以利用层缓存

README.md

@@ -16,7 +16,7 @@
 
 ## 环境要求
 
-- Node.js 22（见 [.nvmrc](./.nvmrc)，推荐使用 nvm 管理）
+- Node.js 24 LTS（见 [.nvmrc](./.nvmrc)，推荐使用 nvm / fnm 管理）；最低 22.22.2（jsdom、Cesium 等依赖的引擎要求）
 - pnpm 10+（`packageManager` 字段已钉住版本）
 - 国内开发者可在 `~/.npmrc` 自行配置镜像源（本仓库的 `.npmrc` 不携带镜像配置）
 

THIRD-PARTY-NOTICES.md

@@ -38,4 +38,5 @@
 - `react-router@6.30.4` ×2（moderate）：反斜杠 open redirect 与 SSR hydration 注入。6.x 无补丁（修复在 7.18.0），受 @umijs/max 4 约束无法升级；本项目所有路由跳转目标均为代码常量、纯 SPA 无 SSR，实际不可利用。umi 升级 5/react-router 7 时一并闭环。
 - `uuid@8.3.2`（moderate）：exceljs 传递依赖，仅 v3/v5/v6 且调用方传自定义 buffer 才触发，exceljs 内部只用 v4，不受影响。
 - `decode-uri-component@0.2.2`（moderate）：@umijs/history 传递依赖，畸形 percent-encoding 的 DoS，需超长构造串，风险低。
-- `postcss-selector-parser` / `elliptic`（low）：构建链与 webpack polyfill 链，无补丁或无运行时暴露。
+- `postcss-selector-parser`（low，**已消解**）：构建链使用。已通过 6.1.3 / 7.1.3 两条 override 消除（2026-09-23）。
+- `elliptic`（low）：审计命中的是 umi 构建链 node-libs-browser → crypto-browserify，上游无补丁。产物里另有一份随 exceljs 预打包浏览器版带入的 elliptic，exceljs 只用 createHash 做工作表保护哈希，不做 EC 签名/验签，不触及该公告的风险路径。

config/splitChunks.ts

@@ -21,7 +21,8 @@ type WebpackChainConfig = {
  *   @antv/g 的依赖）与 xgplayer/wavesurfer 绑在一起、d3 组把图表库用到的 d3-* 与 D3 页的
  *   全部 d3 绑在一起，首页因此白白下载播放器与整份 d3。这类跨域共享的库交给 webpack
  *   按实际引用关系自动拆分；
- * - cesium 包只是 re-export，引擎代码在 @cesium/engine、@cesium/widgets，分组正则须覆盖。
+ * - cesium 包只是 re-export，引擎代码在 @cesium/engine、@cesium/widgets，分组正则须覆盖；
+ * - antd 的 rc 组件正逐步迁往 @rc-component/* 作用域（5.29 已有 5 个，6.x 全部迁移），antd 分组须覆盖。
  * 路由级真实首屏体积由 config/chunkGraph.ts 记录、scripts/check-bundle-size.mjs 门禁。
  */
 export const configureSplitChunks = (config: WebpackChainConfig) => {
@@ -43,7 +44,7 @@ export const configureSplitChunks = (config: WebpackChainConfig) => {
       },
       antd: {
         name: 'vendor-antd',
-        test: /[\\/]node_modules[\\/](@ant-design|antd|rc-.+)[\\/]/,
+        test: /[\\/]node_modules[\\/](@ant-design|@rc-component|antd|rc-.+)[\\/]/,
         priority: 40,
         enforce: true,
       },

package.json

@@ -47,35 +47,38 @@
     "@ant-design/icons": "^5.6.1",
     "@ant-design/plots": "^2.6.8",
     "@ant-design/pro-components": "^2.8.10",
-    "@dnd-kit/core": "^6.0.8",
+    "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/modifiers": "^6.0.1",
     "@dnd-kit/sortable": "^7.0.2",
-    "@fullcalendar/core": "^6.1.8",
-    "@fullcalendar/daygrid": "^6.1.8",
-    "@fullcalendar/interaction": "^6.1.8",
-    "@fullcalendar/multimonth": "^6.1.8",
-    "@fullcalendar/react": "^6.1.8",
-    "@fullcalendar/timegrid": "^6.1.8",
-    "@pansy/react-amap": "^2.18.1",
+    "@dnd-kit/utilities": "^3.2.2",
+    "@fullcalendar/core": "^6.1.21",
+    "@fullcalendar/daygrid": "^6.1.21",
+    "@fullcalendar/interaction": "^6.1.21",
+    "@fullcalendar/multimonth": "^6.1.21",
+    "@fullcalendar/react": "^6.1.21",
+    "@fullcalendar/timegrid": "^6.1.21",
+    "@pansy/react-amap": "^2.21.0",
     "@tinymce/tinymce-react": "^6.3.0",
     "@turf/helpers": "^7.2.0",
     "@turf/union": "^7.2.0",
     "@umijs/max": "^4.7.19",
-    "antd": "^5.17.3",
-    "cesium": "^1.141.0",
+    "antd": "^5.29.3",
+    "cesium": "^1.145.0",
     "cesium-navigation-es6": "^3.0.9",
+    "classnames": "^2.5.1",
     "d3": "^7.9.0",
-    "dayjs": "^1.11.11",
+    "dayjs": "^1.11.23",
     "dompurify": "^3.4.15",
     "exceljs": "^4.4.0",
     "html2canvas": "^1.4.1",
-    "ol": "^9.2.2",
-    "react-pdf": "^10.4.1",
-    "signature_pad": "^4.1.6",
-    "tinymce": "^8.9.1",
-    "wavesurfer.js": "^7.1.4",
-    "xgplayer": "^3.0.8",
-    "xgplayer-music": "^3.0.8"
+    "ol": "^9.2.4",
+    "pdfjs-dist": "5.4.296",
+    "react-pdf": "^10.5.0",
+    "signature_pad": "^4.2.0",
+    "tinymce": "^8.9.2",
+    "wavesurfer.js": "^7.12.12",
+    "xgplayer": "^3.0.26",
+    "xgplayer-music": "^3.0.26"
   },
   "devDependencies": {
     "@types/d3": "^7.4.3",
@@ -87,68 +90,70 @@
     "cross-env": "^7.0.3",
     "eslint-plugin-jsx-a11y": "^6.10.2",
     "husky": "^8.0.3",
-    "jsdom": "^30.1.0",
-    "lint-staged": "^13.2.3",
-    "prettier": "^3.0.1",
-    "prettier-plugin-organize-imports": "^3.2.3",
-    "prettier-plugin-packagejson": "^2.4.5",
+    "jsdom": "^30.1.1",
+    "lint-staged": "^13.3.0",
+    "prettier": "^3.9.8",
+    "prettier-plugin-organize-imports": "^3.2.4",
+    "prettier-plugin-packagejson": "^2.5.22",
     "tailwindcss": "^3.4.19",
     "typescript": "^5.9.3",
     "vitest": "^5.0.1"
   },
   "packageManager": "pnpm@10.33.0",
   "engines": {
-    "node": ">=20"
+    "node": "^22.22.2 || >=24.15.0"
   },
   "pnpm": {
     "overrides": {
-      "axios@<1": "1.20.0",
+      "@babel/core@<7.29.6": "7.29.6",
       "@babel/runtime@<7.26.10": "7.28.4",
+      "@hono/node-server@<1.19.15": "1.19.15",
+      "@remix-run/router@<1.23.3": "1.23.3",
+      "axios@<1": "1.20.0",
+      "baseline-browser-mapping@<2.11.0": "2.11.0",
+      "body-parser@>=1.20.0 <1.20.6": "1.20.6",
+      "brace-expansion@>=2.0.0 <2.1.4": "2.1.4",
+      "brace-expansion@>=1.0.0 <1.1.21": "1.1.21",
       "braces@<3.0.3": "3.0.3",
+      "browserslist@>=4.0.0 <4.28.7": "4.28.7",
+      "colord@<2.9.4": "2.9.4",
       "cross-spawn@>=7.0.0 <7.0.5": "7.0.6",
+      "dompurify@>=3.0.0 <3.4.13": "3.4.13",
       "es5-ext@<0.10.63": "0.10.64",
       "esbuild@<0.25.0": "0.25.12",
+      "fast-uri@>=3.0.0 <3.1.6": "3.1.6",
+      "form-data@>=4.0.0 <4.0.6": "4.0.6",
       "glob@>=10.2.0 <10.5.0": "10.5.0",
+      "hono@>=4.0.0 <4.13.5": "4.13.5",
       "immer@>=7.0.0 <9.0.6": "9.0.21",
-      "lodash-es@>=4.0.0 <=4.17.23": "4.18.1",
+      "immutable@>=4.0.0 <4.3.9": "4.3.9",
+      "js-yaml@>=4.0.0 <4.3.2": "4.3.2",
+      "js-yaml@>=3.0.0 <3.15.2": "3.15.2",
+      "less@<4.9.1": "4.9.1",
       "lodash@>=4.0.0 <=4.17.23": "4.18.1",
+      "lodash-es@>=4.0.0 <=4.17.23": "4.18.1",
       "micromatch@<4.0.8": "4.0.8",
       "minimatch@<3.1.4": "3.1.5",
+      "nanoid@>=3.0.0 <3.3.18": "3.3.18",
       "node-fetch@<2.6.7": "2.7.0",
-      "path-to-regexp@>=0.2.0 <1.9.0": "1.9.0",
       "path-to-regexp@>=8.0.0 <8.4.0": "8.4.2",
+      "path-to-regexp@>=0.2.0 <1.9.0": "1.9.0",
       "picomatch@<2.3.2": "2.3.2",
+      "piscina@>=4.0.0 <4.9.3": "4.9.3",
+      "postcss@>=8.4.31 <8.5.23": "8.5.23",
+      "postcss-selector-parser@>=7.1.0 <7.1.3": "7.1.3",
+      "postcss-selector-parser@>=6.1.0 <6.1.3": "6.1.3",
+      "protobufjs@>=8.0.0 <8.6.6": "8.6.6",
       "protocol-buffers-schema@<3.6.1": "3.6.1",
-      "send@<0.19.0": "0.19.2",
-      "webpack@<5.104.1": "5.104.1",
-      "yaml@<1.10.3": "1.10.3",
-      "yaml@>=2.0.0 <2.8.3": "2.8.3",
+      "qs@>=6.0.0 <6.16.0": "6.16.0",
       "react-router@>=6.0.0 <6.30.4": "6.30.4",
-      "@remix-run/router@<1.23.3": "1.23.3",
-      "brace-expansion@>=1.0.0 <1.1.21": "1.1.21",
-      "brace-expansion@>=2.0.0 <2.1.4": "2.1.4",
-      "js-yaml@>=4.0.0 <4.3.2": "4.3.2",
-      "js-yaml@>=3.0.0 <3.15.2": "3.15.2",
-      "fast-uri@>=3.0.0 <3.1.6": "3.1.6",
-      "nanoid@>=3.0.0 <3.3.18": "3.3.18",
-      "immutable@>=4.0.0 <4.3.9": "4.3.9",
-      "browserslist@>=4.0.0 <4.28.7": "4.28.7",
-      "postcss@>=8.4.31 <8.5.23": "8.5.23",
-      "ws@>=8.0.0 <8.21.0": "8.21.0",
+      "send@<0.19.0": "0.19.2",
       "svgo@>=2.0.0 <2.8.4": "2.8.4",
-      "form-data@>=4.0.0 <4.0.6": "4.0.6",
-      "qs@>=6.0.0 <6.16.0": "6.16.0",
-      "protobufjs@>=8.0.0 <8.6.6": "8.6.6",
-      "piscina@>=4.0.0 <4.9.3": "4.9.3",
-      "dompurify@>=3.0.0 <3.4.13": "3.4.13",
-      "colord@<2.9.4": "2.9.4",
-      "baseline-browser-mapping@<2.11.0": "2.11.0",
-      "@babel/core@<7.29.6": "7.29.6",
-      "body-parser@>=1.20.0 <1.20.6": "1.20.6",
-      "hono@>=4.0.0 <4.13.5": "4.13.5",
       "tmp@<0.2.6": "0.2.7",
-      "@hono/node-server@<1.19.15": "1.19.15",
-      "less@<4.9.1": "4.9.1"
+      "webpack@<5.104.1": "5.104.1",
+      "ws@>=8.0.0 <8.21.0": "8.21.0",
+      "yaml@>=2.0.0 <2.8.3": "2.8.3",
+      "yaml@<1.10.3": "1.10.3"
     }
   }
 }