[kcrmin]

What and why

pnpm audit on develop reports 30 advisories (8 high, 18 moderate, 4 low), all in the build and test toolchain:

• vite 8.1.5 (launch-editor existence check and related), plus postcss, nanoid and source-map-js under it
• vitest / @vitest/mocker 4.1.10 (path traversal)
• undici 7.28.0 under jsdom 29.1.1 (18 advisories, fixed only in 7.30.1+)

Changes, one commit each:

• vite 8.1.5 -> 8.1.6, refreshing postcss 8.5.31, nanoid 3.3.20 and source-map-js 1.2.2 within vite's ranges (the refresh also moved @testing-library/dom's @babel/runtime to 7.29.10)
• vitest 4.1.10 -> 4.1.12 (all @vitest/* follow)
• jsdom 29.1.1 -> 30.1.3, which moves to undici 8.12.3 and clears every undici advisory. jsdom 30 needs Node ^24.15.0; CI and engines already use Node 24.

Remaining audit

pnpm audit after this branch: 1 high

• react-router 7.18.1 (via react-router-dom): RSC Mode CSRF bypass, patched in 7.18.2. The app does not use RSC mode; left for a separate runtime-dependency bump since it ships in the bundle.

Verified

All on Node 24.22.1:

• pnpm install --frozen-lockfile: clean
• node --test scripts/test-github-action-pins.mjs scripts/test-real-api-integration-workflow.mjs: 2 passed
• pnpm typecheck: clean
• pnpm exec vitest run: 58 files, 688 tests; green on reruns. The only failures seen were the two known focus races fixed by fix(competition): keep dialog focus on re-render #185 and test(strategy): wait for frame-deferred cap focus #186, which fail just as often on develop (isolated run of the two files: 6/6 on develop, 5/6 here). With fix(competition): keep dialog focus on re-render #185 and test(strategy): wait for frame-deferred cap focus #186 applied on top, 6/6 isolated runs and 3/3 full runs passed (689 tests)
• pnpm build && node scripts/assert-production-bundle.mjs: passed
• CI=1 pnpm e2e: 26 passed
• CI=1 pnpm e2e:operator-session: 1 passed
• pnpm audit: 30 -> 1 advisory
• Test output warnings unchanged before and after the jsdom bump

Checklist

• Dev and test dependencies only; no runtime dependency changed
• Lockfile installs with --frozen-lockfile
• Remaining advisory recorded above
• Best merged after fix(competition): keep dialog focus on re-render #185 and test(strategy): wait for frame-deferred cap focus #186 for a stable unit-test job

Related: #185, #186