Frontend: Drop unused "escape-string-regexp" dep, refresh tooling

Removes the top-level "escape-string-regexp" dependency, which has no
direct consumer in our source. The v4 line lives on as a transitive
dep of "eslint" and "sanitize-html"; "webpack-bundle-analyzer" keeps
its nested v5 copy. Net dep-tree shape is unchanged.

Also bumps "@vue/language-server" to ^3.3.0, adds "vuln" and "tools"
phony aliases in the Makefile, and aligns the frontend "audit" target
with the root one (--no-fund --no-audit).

Signed-off-by: Michael Mayer <michael@photoprism.app>

Author: lastzero

Makefile

@@ -276,9 +276,10 @@ dep-list:
 	go list -u -m -json all | go-mod-outdated -direct
 dep-list-all:
 	go list -u -m -json all | go-mod-outdated
+vuln: audit
 audit: audit-frontend audit-backend
 audit-frontend:
-	$(MAKE) -C frontend audit
+	npm audit --ignore-scripts --no-fund --no-audit --no-update-notifier
 audit-backend: dep-vuln
 dep-audit: dep-vuln
 dep-vuln:
@@ -302,6 +303,7 @@ dep-npm:
         fi
 dep-js:
 	npm ci --ignore-scripts --no-update-notifier --no-audit
+tools: gh claude codex
 codex: dep-codex codex-version codex-skills
 codex-version:
 	@echo "🤖 Installed $$(codex --version)."

NOTICE

@@ -9,7 +9,7 @@ The following 3rd-party software packages may be used by or distributed with
 PhotoPrism. Any information relevant to third-party vendors listed below are
 collected using common, reasonable means.
 
-Date generated: 2026-05-18
+Date generated: 2026-05-19
 
 ================================================================================
 
@@ -9638,7 +9638,6 @@ core-js                          MIT            Denis Pushkarev zloirock@zloiroc
 cross-env                        MIT            Kent C. Dodds <me@kentcdodds.com> (https://kentcdodds.com)
 css-loader                       MIT            Tobias Koppers @sokra
 cssnano                          MIT            Ben Briggs beneb.info@gmail.com http://beneb.info
-escape-string-regexp             MIT            Sindre Sorhus sindresorhus@gmail.com https://sindresorhus.com
 eslint                           MIT            Nicholas C. Zakas <nicholas+npm@nczconsulting.com>
 eslint-config-prettier           MIT            Simon Lydell
 eslint-formatter-pretty          MIT            Sindre Sorhus sindresorhus@gmail.com https://sindresorhus.com

frontend/Makefile

@@ -66,7 +66,7 @@ watch:
 build:
 	npm run build
 audit:
-	npm audit --ignore-scripts --no-update-notifier
+	npm audit --ignore-scripts --no-fund --no-audit --no-update-notifier
 lint:
 	npm run lint || true
 fmt:

frontend/NOTICE

@@ -28,7 +28,6 @@ core-js                          MIT            Denis Pushkarev zloirock@zloiroc
 cross-env                        MIT            Kent C. Dodds <me@kentcdodds.com> (https://kentcdodds.com)
 css-loader                       MIT            Tobias Koppers @sokra
 cssnano                          MIT            Ben Briggs beneb.info@gmail.com http://beneb.info
-escape-string-regexp             MIT            Sindre Sorhus sindresorhus@gmail.com https://sindresorhus.com
 eslint                           MIT            Nicholas C. Zakas <nicholas+npm@nczconsulting.com>
 eslint-config-prettier           MIT            Simon Lydell
 eslint-formatter-pretty          MIT            Sindre Sorhus sindresorhus@gmail.com https://sindresorhus.com

frontend/README.md

@@ -54,7 +54,6 @@ Some major upgrades are blocked by config-file module style. The configs referen
 |-------------------------------|--------|--------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `postcss-preset-env` 11.x     | ESM    | `frontend/postcss.config.js` is CommonJS (`module.exports = { plugins: [require("postcss-preset-env"), ...] }`).                                       |
 | `webpack-manifest-plugin` 6.x | ESM    | `frontend/webpack.config.js` is CommonJS (`require("webpack-manifest-plugin")`). Webpack accepts ESM configs, but the migration is non-trivial.        |
-| `escape-string-regexp` 5.x    | ESM    | v5 is ESM-only; verify every consumer (including transitive build-time tooling) before bumping.                                                        |
 | `vuetify` 4.x                 | —      | See the `vuetify` row in [Currently Pinned Packages](#currently-pinned-packages); also a separate v3 → v4 migration project.                           |
 | `vue-router` 5.x              | —      | Major release with breaking changes across `frontend/src/app/routes.js` and dynamic imports. Needs its own evaluation pass with TestCafe verification. |
 

frontend/package.json

@@ -51,7 +51,7 @@
     "@vitest/coverage-v8": "^3.2.4",
     "@vitest/ui": "^3.2.4",
     "@vue/compiler-sfc": "^3.5.34",
-    "@vue/language-server": "^3.2.9",
+    "@vue/language-server": "^3.3.0",
     "@vue/test-utils": "^2.4.10",
     "@vvo/tzdb": "^6.198.0",
     "axios": "1.16.1",
@@ -64,7 +64,6 @@
     "cross-env": "^10.1.0",
     "css-loader": "^7.1.4",
     "cssnano": "^7.1.9",
-    "escape-string-regexp": "^4.0.0",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-formatter-pretty": "^6.0.1",