[contrem]

Linear Link

https://linear.app/atomicbuilt/issue/DD-4224

Fixes the failing vuln-dep-check job, which currently fails on master because of high-severity advisories for transitive dependencies (through vitest).

npm run audit:fix (lockfile only, no breaking changes) resolves:

• vite 8.0.0–8.1.5 → 8.3.5 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22)
• source-map-js → 1.2.2 (GHSA-68fv-2mgg-jv7q)

npm audit now reports 0 vulnerabilities at any severity.

Verified locally on Node 24.19.0 (matching master's .nvmrc), running every step of test.yml: npm ci, "Validate lockfile", format:ci, 4/4 tests and typecheck:ci all pass, and audit-ci passes. Because .npmrc sets min-release-age=2 and audit:fix bypasses it, I also confirmed that npm install --package-lock-only with the default settings produces no lockfile drift, on both Node 24.19.0 and 24.22.1.

Unblocks vuln-dep-check on #39 (DD-4223).

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactor (non-breaking change which cleans up code)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• This change impacts security

Checklist:

• New and existing tests pass locally with my changes
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I have followed the Code Review and Code Review Security guidelines
• I have checked my code against flaws from the OWASP Top 10
  • A01:2021-Broken Access Control
  • A02:2021-Cryptographic Failures
  • A03:2021-Injection
  • A04:2021-Insecure Design
  • A05:2021-Security Misconfiguration
  • A06:2021-Vulnerable and Outdated Components
  • A07:2021-Identification and Authentication Failures
  • A08:2021-Software and Data Integrity Failures
  • A09:2021-Security Logging and Monitoring Failures
  • A10:2021-Server-Side Request Forgery

🤖 Generated with Claude Code