Migrate d3_graph_generator from react-scripts (CRA) to Vite

[dduugg]

Summary

Create React App is officially deprecated upstream — facebook/create-react-app's README now says "Create React App... is now in long-term stasis... we do not recommend starting production apps based on Create React App" — and react-scripts hasn't been released since April 2022. Its frozen webpack/babel/eslint toolchain is the entire reason d3_graph_generator kept accumulating Dependabot alerts on packages several levels deep in the tree (postcss, webpack-dev-server, minimatch, js-yaml, ajv, ...) that Dependabot can't bump directly, and that needed hand-maintained yarn resolutions overrides to patch (see #111).

This replaces react-scripts with Vite, removing that entire dependency subtree outright instead of continuing to patch it package-by-package.

Verified impact (measured against an actual install of the pre-migration commit, not estimated):

• node_modules: 848 packages → 59
• yarn.lock: 9,791 lines → 620
• yarn audit: 199 vulnerabilities (2 critical / 125 high / 56 moderate / 16 low) → 0

Changes

• package.json: drop react-scripts and its transitive baggage, plus @observablehq/stdlib, web-vitals, and @testing-library/* (all confirmed unused — no test files exist, no reportWebVitals call, no stdlib import anywhere in src/). Add vite + @vitejs/plugin-react. The eslintConfig/browserslist blocks are removed since they configured react-scripts' bundled tooling specifically.
• vite.config.js (new): configures the React plugin, keeps the dev server on port 3000 (matching the documented workflow) and build output in build/ (matching the existing .gitignore entry).
• index.html: moved from public/ to the project root per Vite convention. Dropped the stale, insecure http://d3js.org/d3.v3.min.js CDN script tag — the app only ever uses the npm-installed d3@7 via ESM imports (import * as d3 from "d3" in buildGraph.js), so this was dead, unused, mixed-content markup, not a functional dependency. Replaced %PUBLIC_URL% templating with root-relative paths and added the module entry script tag.
• src/index.js → src/index.jsx: renamed so esbuild's default JSX loader picks it up (it's the only source file with JSX in a .js extension; the other components were already .jsx). No content changes — confirmed byte-identical aside from the rename.
• README.md: yarn start → yarn install (first time) + yarn dev.

No application source files (App.jsx, ForceGraph.jsx, NodeDetails.jsx, buildGraph.js, index.css) were touched. d3_graph_generator has no coupling to the rest of the Ruby gem or to CI — nothing else in the repo references its build output, filenames, or manifest.

Test plan

Verified independently (fresh clones, not just re-running my own working directory):

• yarn install — zero errors, zero peer-dependency warnings (the old CRA tree had several)
• yarn build — succeeds in ~280ms, emits build/index.html + hashed JS/CSS assets + copied public/ assets
• yarn preview — served index.html, the JS bundle, the CSS bundle, and /manifest.json, all HTTP 200 with real (non-empty, non-error) content
• yarn dev — serves on port 3000 as configured/documented, / and /src/index.jsx both HTTP 200
• Diff-reviewed for regressions: no leftover CRA references anywhere in the tree, dropped dependencies re-confirmed unused by grep (not just trusted), index.html changes confirmed semantically equivalent to the original
• Merge and have a human click around the actual graph in a browser (ruby parse_packwerk_integration.rb against a real repo, then yarn dev) — nothing in this migration should change runtime behavior, but I don't have a way to visually confirm the rendered force graph from this environment