chore(security): close dependabot alerts q2#3456

Merged

nicktrn merged 15 commits intomainfrom

security/dependabot-alerts-q2

Apr 28, 2026

Commits on Apr 27, 2026

chore(security): bump vite to 6.4.2 via override + drop unused root devDep
nicktrn
committed
chore(security): dev-only overrides for rollup, flatted, picomatch, minimatch
nicktrn
committed
chore(security): override protobufjs + fast-xml-parser for critical CVEs
nicktrn
committed
chore(security): bump existing overrides + dompurify direct dep
nicktrn
committed
chore: bump testcontainers + rimraf in dev/test deps
nicktrn
committed
chore(security): bump nodemailer 7 -> 8 for CRLF injection CVE
nicktrn
committed
chore(security): bump uuid 9 -> 14 in webapp; drop unused uuid dep from sdk
nicktrn
committed
chore(security): bump tar in cli-v3 + override for supervisor k8s chain
nicktrn
committed
chore(security): override path-to-regexp 0.1.x for express 4 ReDoS
nicktrn
committed
chore(security): tighten override matchers + add ajv/socket.io-parser/postcss/yaml/semver/defu
nicktrn
committed
chore(security): bump effect 3.11 -> 3.21 in webapp for AsyncLocalStorage CVE
nicktrn
committed
chore: regenerate lockfile for minimal diff against main
nicktrn
committed
fix(testcontainers): convert stop() timeouts to ms for v11 + drop stale tar-fs override
nicktrn
committed
fix(webapp): bundle uuid in remix server build + drop redundant @types/dompurify
nicktrn
committed
chore(security): tighten lodash override lower bound to 4.17
nicktrn
committed