[ernst-dev]

Updates 3 development dependencies to patched releases (lockfile only) to resolve all 9 open security alerts.

Merging this PR is expected to resolve all 9 of this repository's open security alerts.

Alerts addressed

• GHSA-8r9p-f939-6h3c: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-q3jh-wrc6-jgq8: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-xjj6-f33q-929c: undici, high, 6.28.1 -> 6.29.1
• GHSA-xjj6-f33q-929c: undici, high, 7.29.1 -> 7.30.1
• GHSA-698v-4r3x-3vcv: vite, medium, 8.0.16 -> 8.3.5
• GHSA-587h-7wmj-h5pm: vite, high, 8.0.16 -> 8.3.5
• GHSA-r825-w8mm-5pxw: vite, medium, 8.0.16 -> 8.3.5
• GHSA-rq7h-c2jc-7f22: vite, medium, 8.0.16 -> 8.3.5
• GHSA-9jrq-w75r-8gcw: vite, low, 8.0.16 -> 8.3.5

How it was fixed

vite is a direct dev dependency and was updated within its existing ^8.0.16 range with npm update vite --package-lock-only. The fixed release is 8.1.6; the lockfile moves to 8.3.5, which is the same version the open Dependabot PR targets. Because that spans several minor versions, vite also moves the build packages it requires: rolldown (1.0.3 -> 1.2.16) and its platform bindings, lightningcss and its platform bindings (1.32.0 -> 1.33.0), @oxc-project/types, postcss, nanoid and picomatch; four WebAssembly helper packages that the new rolldown no longer needs are removed. undici appears twice in the lockfile, on two major lines, and each was updated within its own line (7.29.1 -> 7.30.1 and 6.28.1 -> 6.29.1). follow-redirects was updated within its parent range. package.json is unchanged and every changed entry is marked dev.

Why one pull request

The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.

Dependabot PRs closed by this change

These PRs update packages that this PR also updates, so they are closed in its favor. Each can be restored by commenting @dependabot reopen on it if this PR fails CI or is abandoned (Dependabot will not recreate it by itself for that version).

• chore: Bump vite from 8.0.16 to 8.3.5 #266: Bump vite from 8.0.16 to 8.3.5

Verification

Run locally on this commit: npm run build passes and npm run test:unit passes (52 test suites, 480 tests). The integration tests need a browser and were not run locally; please rely on CI for those.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.07%. Comparing base (1f1d34f) to head (1d3201f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #268   +/-   ##
=======================================
  Coverage   99.07%   99.07%           
=======================================
  Files          49       49           
  Lines        1399     1399           
  Branches      384      382    -2     
=======================================
  Hits         1386     1386           
  Misses         12       12           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.