chore(deps): weekly security sweep, patch all open Dependabot alerts (wk 3)

[PAMulligan]

Closes #116.

The issue named three alerts, but by now there were ~50 open Dependabot alerts across the root lockfile, the Astro template lockfile, and the other templates' manifests. This PR remediates all of them with in-range updates. No new pnpm.overrides were needed: every patched version fits its parent's declared range, including the three called out in the issue (js-yaml, @babel/core, esbuild).

Release-age guard

No minimumReleaseAge is configured in this repo, so I applied a 7-day cooldown by hand via pnpm's minimum-release-age setting during resolution (e.g. it chose nanoid 3.3.18 from Aug 7 over 3.3.19 from Sep 10). If the org standard is a different window, say so and I will re-resolve.

Root workspace

pnpm update -r --depth Infinity with pnpm 10 (the version that wrote the current lockfile). Ranges in package.json were raised by the same command; every bump stays within its current major.

Package	Before	After	Alerts
js-yaml	4.1.1	4.3.2	#43 #57 #71 #109
fast-uri	3.1.2	3.1.7	#54 #55 #68 #82 #85 #86
brace-expansion	1.1.13 / 5.0.5	1.1.18 / 5.0.9	#45 #58
browserslist	4.28.2	4.28.9	#88
baseline-browser-mapping	2.10.19	2.11.21	#103
nanoid	3.3.16	3.3.18	#80
postcss	8.5.22	8.5.28	#60 #77
@humanfs/node	0.16.7	0.16.8	#84
@babel/core	7.29.0	7.29.7	#37

pnpm audit --audit-level moderate (the CI security job): 34 findings on main → 0. The qs override is preserved.

templates/astro

Its lockfile was stale (astro 6.4.8 resolved against a ^7.2.8 manifest after #124/#125 bumped only the manifest), so it is regenerated from scratch with the same cooldown: astro 7.3.1, esbuild 0.28.2, sharp 0.35.4, smol-toml 1.8.0, svgo 4.1.0, browserslist 4.28.9, undici 7.29.1, js-yaml 4.3.2, vitest 4.1.11. astro build passes. @testing-library/jest-dom is narrowed to ~6.9.1 (6.10.0 is deprecated upstream as an accidental breaking minor); applied to the vite and nextjs templates too.

templates/{vite,nextjs,vue,sveltekit}

vitest and @vitest/coverage-v8 ^3.0.0 → ^4.1.11 (#94–#97). Their vitest config templates use only globals, environment, setupFiles, include, exclude, and coverage.{provider,reporter,exclude,thresholds}, none of which changed in vitest 4. Each manifest resolves cleanly with vite 6/7.

Docs accuracy pass

• README quick start said cd app, but setup-project.sh creates a directory named after the project. Fixed here and in the onboarding quickstart.
• Quickstart told readers to activate pnpm@latest. pnpm 12 ignores pnpm.overrides in package.json and would silently drop the override section from the lockfile (the failure mode behind chore(deps): bump pdfjs-dist from 6.0.227 to 6.2.108 #120/chore(deps-dev): bump vitest from 4.1.2 to 4.1.11 #126). Now pins 10.34.5, matching build: pin pnpm 10 via packageManager so Dependabot and CI agree #127.
• Onboarding prerequisites: pnpm 8+ → 10.x (Node already updated to 22.13+ in chore(deps): bump pdfjs-dist from 6.0.227 to 6.2.108 #120).
• Agent count: README and all docs already say 56 and check-doc-counts.sh passes. The GitHub repo description still said 53; I updated it to 56 via gh repo edit.
• Version badges: there are no shields badges anywhere in the repo, so nothing to verify.
• Fresh-clone install: pnpm install --frozen-lockfile passes under both pnpm 9 (CI) and pnpm 10.

Verification

• Pipeline package: typecheck, 133 tests, build. Script suite: 512 tests. lint-and-format.sh --check, check-doc-counts.sh, validate-pipeline-config.js all pass.
• Both lockfiles pass pnpm install --frozen-lockfile under pnpm 9.15.9 and 10.34.5.

Not done / follow-ups

• Major upgrades left alone: @commitlint 20→21, @stryker-mutator 9→10, @babel/core 7→8, and eslint 9→10 inside the templates (eslint 9 is deprecated upstream).
• chore(deps-dev): bump vitest from 4.1.2 to 4.1.11 #126 (vitest 4.1.11) is superseded by this PR and will conflict on the lockfile; close it once this merges.
• build: pin pnpm 10 via packageManager so Dependabot and CI agree #127 pins pnpm so Dependabot stops regenerating lockfiles with pnpm 11. Independent of this PR but recommended alongside it.

🤖 Generated with Claude Code