[Fix] Track frontend lockfile + migrate to public @penguintechinc/react-libs

[PenguinzTech]

Summary

Two frontend fixes for the hub module web UI (admin/hub_module/frontend):

1. Track the frontend lockfile (fix(frontend): regenerate package-lock.json and enable its tracking) — package-lock.json was previously gitignored/untracked. This regenerates it and updates .gitignore so the lockfile is committed, giving reproducible, hash-verified installs (npm ci) in CI and Docker builds.
2. Migrate to the public shared library (feat(frontend): migrate @penguin/react_libs to public @penguintechinc/react-libs) — swaps the old @penguin/react_libs dependency for the public npm package @penguintechinc/react-libs (v1.3.4) and updates all component imports across the admin/superadmin/public pages.

Changes

• admin/hub_module/frontend/package.json — dependency swapped to public @penguintechinc/react-libs
• admin/hub_module/frontend/package-lock.json — regenerated, now tracked
• .gitignore — stop ignoring the frontend lockfile
• Import updates across ~14 frontend .jsx pages/components

Why this matters

The desktop client depends on this landing — it consumes the same public @penguintechinc/react-libs package, and a tracked, reproducible lockfile is a prerequisite for its build. This unblocks that downstream work.

Notes

• Frontend-only change; no backend/API surface touched.
• No secrets introduced.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​react-router-dom@​7.13.0 ⏵ 7.18.2				-1
	npm/​@​penguintechinc/​react-libs@​1.3.4
	npm/​@​types/​react-dom@​18.3.5
	npm/​@​types/​react@​18.3.27 ⏵ 18.3.18
	npm/​reactflow@​11.11.4 ⏵ 11.10.1			+1
	npm/​eslint-plugin-react@​7.37.3
	npm/​vite@​6.4.1 ⏵ 6.4.3		+24		+2
	npm/​socket.io-client@​4.8.3 ⏵ 4.8.1
	npm/​tailwindcss@​3.4.19 ⏵ 3.4.17				-1
	npm/​eslint-plugin-react-refresh@​0.4.26 ⏵ 0.4.16			+1	+2
	npm/​autoprefixer@​10.4.23 ⏵ 10.4.20			+3	-2
	npm/​@​vitejs/​plugin-react@​4.7.0 ⏵ 4.3.4	+1			+1
	npm/​eslint-plugin-react-hooks@​5.1.0

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Obfuscated code: npm eslint-plugin-react is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: admin/hub_module/frontend/package-lock.json → npm/eslint-plugin-react@7.37.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-react@7.37.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm normalize-range was last published 11 years ago Last Publish: 9/13/2015, 5:20:04 AM From: admin/hub_module/frontend/package-lock.json → npm/autoprefixer@10.4.20 → npm/normalize-range@0.1.2 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/normalize-range@0.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report