MAINT: Update npm dependencies - #326

date-fns v4 adds first-class time zone support; the only breaking
changes concern TypeScript types and internal module layout. The
formatDistanceToNow API used in src/lib/date-formatting.js is
unchanged, and date-fns-tz 3.2 supports date-fns ^4.

feed v6 validates item ids as URLs when rendering Atom (Atom <id> must
be an IRI), so the bare post slug threw 'Invalid URL' and atom.xml was
silently not written. Use the post URL as the item id, and await
generateRssFeed in getStaticProps so feed errors fail the build
instead of being swallowed as an unhandled rejection.

The only breaking changes in glob 12/13 affect the CLI (unsafe --shell
removed, CLI moved to glob-bin); the glob.sync API used in
src/lib/posts.js is unchanged.

v3 stops writing to global.DOMPurify and adds named exports; switch
src/lib/sanitize-html.js to the named 'sanitize' export.

Pinned to ~3.19.0 rather than v4: 3.20+ / 4.x pull in jsdom 30, whose
undici dependency crashes on Node 20 ('Cannot read properties of
undefined (reading bind)') and requires Node ^22.22.2 || ^24.15.0.
The deploy workflow still builds on Node 20, so v4 is held back until
CI moves to a newer Node.

KaTeX 0.18 prefixes all internal CSS classes, so the stylesheet
imported from katex/dist must match the KaTeX version that renders the
math. rehype-katex 7 still declares katex ^0.16, so add an npm
override forcing it (and micromark-extension-math) onto the top-level
katex version. Its renderToString API is unchanged.

Other breaking changes (strict-mode reporting of missing metrics in
0.19, internal __defineFunction API in 0.17) do not affect this site.

v3 is a rewrite in TypeScript published as ESM-only; the default
export and the initialize()/send() API used in layout.js are
unchanged.

v16 upgrades its refractor dependency to v5 (security fixes). The
Prism component and the dist/cjs/styles/prism import path used in
src/components/mdx/code.js are unchanged; verified Python code still
tokenises and renders with the nord theme.

react-apexcharts 2 requires apexcharts >=5.10.1, so they are upgraded
together. Neither package is currently imported anywhere in the site,
so no code changes are needed.

v6 adds blockJS/blockDangerousJS serialize options, both defaulting to
true, which strips every JS expression from MDX. That silently dropped
the style={{...}} attribute in the parcels-v4 post. Posts are authored
in this repository, so pass blockJS: false to keep expressions while
leaving blockDangerousJS enabled.

Breaking changes since v11 (gesture callbacks receiving the target
element in v12, removal of the optional @emotion/is-prop-valid
dependency in v13, removal of internal compatibility APIs in v14) do
not affect the motion.div used on the blog index or Chakra UI v2's
internal transitions. Smoke-tested all pages, colour-mode toggle and
the mobile navigation in a headless browser.

Upgrade next, @next/mdx and eslint-config-next to 16.4.3 and migrate:

- next lint was removed in Next.js 16: replace .eslintrc with a flat
  eslint.config.mjs based on eslint-config-next/core-web-vitals and
  run the ESLint CLI directly. (next lint had already been broken
  with ESLint 9.) Fix the two errors it now reports: hooks called
  inside a map callback in desktop-nav.js, and an unescaped
  apostrophe in utrechtteam.js.
- Turbopack is now the default bundler and only accepts serializable
  loader options, so reference rehype-slug by name in the @next/mdx
  config.
- images.domains is deprecated; use images.remotePatterns.
- Turbopack emits a per-page directory under .next/server/pages, so
  the waddendrifters.html page's chunk directory collided with the
  exported waddendrifters.html of the /waddendrifters page (EISDIR).
  Remove the duplicate waddendrifters.html page: on GitHub Pages a
  request for /waddendrifters.html is already served by the
  waddendrifters.html redirect page exported from /waddendrifters.
- Accept the tsconfig.json and next-env.d.ts changes written by
  next build (jsx: react-jsx, generated route type imports).

Upgrade react, react-dom and @types/react to 19. Next.js 16 deprecates
React 18 support for the Pages Router. The site does not use any of
the APIs removed in React 19 (propTypes/defaultProps on function
components, string refs, legacy context, ReactDOM.render, the global
JSX namespace); forwardRef in mdx/link.js is still supported.
Chakra UI v2 runs on React 19 without console errors (checked with a
headless-browser smoke test of every page).

ESLint 10 drops eslintrc support entirely (already migrated to flat
config with the Next.js 16 upgrade) and no longer honours
/* eslint-env */ comments (none in this repo). eslint-config-next
16.4+ supports ESLint 10.

Note: eslint-plugin-react, eslint-plugin-import and
eslint-plugin-jsx-a11y (pulled in by eslint-config-next) have not yet
widened their eslint peer range beyond ^9, so npm prints ERESOLVE
peer warnings. npm ci still succeeds and the plugins' rules run
correctly under ESLint 10.

TypeScript 6 deprecates target ES5 (a hard error in next build's type
check), so raise tsconfig's target to ES2017, the Next.js default.
The target only affects type checking here since Next.js compiles
with SWC.

TypeScript 7 (7.0.2) is held back: its package no longer exposes the
JavaScript compiler API, and typescript-eslint (used by
eslint-config-next) refuses to load with it ('typescript-eslint does
not support TS 7.0'; peer range is <6.1.0).

Chakra UI v3 is a rewrite with a new theming system and compound
component APIs. Migration (codemod-assisted via @chakra-ui/codemod,
then reviewed and finished by hand):

Packages
- @chakra-ui/react 2 -> 3. Remove @chakra-ui/icons, @chakra-ui/next-js
  and @chakra-ui/system (no v3 equivalents; next-js was unused) and
  @emotion/styled (no longer needed). Icons now come from react-icons
  (Lucide set). Add next-themes for colour mode.

Theme and providers
- Replace extendTheme with createSystem/defineConfig in src/theme.js.
  To keep the site looking as before, restore v2's container sizes
  (container.lg etc.), responsive heading scale, inline links that
  inherit text colour, 1rem container padding, dark background
  (gray.800) and border colours.
- Add the official v3 snippets in src/components/ui (provider,
  color-mode, tooltip). _app uses <Provider>; ColorModeScript is
  replaced by next-themes (suppressHydrationWarning on <Html>).

Components
- useColorModeValue/useColorMode-based styling replaced by _dark
  conditions so the static export renders correctly before hydration;
  ColorModeImage renders both images and toggles them with CSS; the
  colour-mode toggle is wrapped in ClientOnly.
- Compound components: Accordion, Alert, Avatar (new AuthorAvatar
  helper), Card, Collapsible, Separator (was Divider), StackSeparator,
  Tooltip snippet; hover Popover -> HoverCard in the desktop nav.
- Prop renames: spacing -> gap, colorScheme -> colorPalette,
  noOfLines -> lineClamp, isOpen -> open, defaultIsOpen -> defaultOpen,
  icon/leftIcon -> children, as={Link} -> asChild, isExternal removed
  (custom Link already sets target/rel for external URLs),
  useClipboard({ value }) returns { copied, copy }.
- MDX lists get explicit list-style types (v3's preflight removes them).
- Drop the unused SocialButton from the footer.