fix(deps): clear known vulnerabilities and add a weekly dependency audit

[rqbazan]

Summary

Clears every advisory pnpm audit reports on main (23 of the 25 open Dependabot alerts) and adds Dependabot security updates plus a weekly dependency audit. The other two alerts (#61, #62: the turbo pin in vland/templates/monorepo/package.json) belong to a separate templates PR.

What was vulnerable

Package	Severity	Runtime/dev	Path	Fix
tinypool 2.1.0	critical (GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr)	dev	oxfmt@0.51.0 (root and @rrlab/oxc-plugin devDependencies)	oxfmt 0.73.0 → tinypool 2.2.0
brace-expansion 5.0.6	high ×5, moderate ×1	runtime (published @rrlab/cli)	@rrlab/cli → glob/rimraf → minimatch	lockfile refresh → 5.0.12
js-yaml 4.1.1	high ×3, moderate ×1	runtime (published @variablelab/clibuddy)	@variablelab/clibuddy → @pnpm/fs.find-packages → read-yaml-file/write-yaml-file	lockfile refresh → 4.3.2
source-map-js 1.2.1	high (GHSA-68fv-2mgg-jv7q)	runtime + dev	magicast (dep of @rrlab/cli, @rrlab/tsdown-plugin); vitest → vite → postcss	lockfile refresh → 1.2.2
vite 8.0.13	high, moderate	dev	vitest → vite (auto-installed peer)	lockfile refresh → 8.3.4
postcss 8.5.15	high, moderate	dev	vitest → vite → postcss	lockfile refresh → 8.5.30
nanoid 3.3.12	high ×2	dev	vitest → vite → postcss → nanoid	lockfile refresh → 3.3.20
vitest, @vitest/mocker 4.1.6	moderate (GHSA-82fw-gwwq-j7x9)	dev	root and @rrlab/vitest-plugin devDependencies (^4.0.0)	lockfile refresh → 4.1.12
turbo 2.8.12	moderate, low	dev	root devDependency	turbo 2.11.9

What changed

 package.json (root devDependencies)
-  "oxfmt": "^0.51.0",
+  "oxfmt": "^0.73.0",
-  "turbo": "2.8.12",
+  "turbo": "2.11.9",

 run-run/oxc-plugin/package.json (devDependencies)
-  "oxfmt": "0.51.0",
+  "oxfmt": "0.73.0",

 pnpm-lock.yaml: targeted refresh of the packages above, all within existing ranges

• The root oxfmt bump alone was not enough: @rrlab/oxc-plugin pins oxfmt 0.51.0 as a devDependency, which kept tinypool 2.1.0 in the lockfile. Its peer range (>=0.30.0) and src/tool-versions.ts are unchanged.
• No style: commit: this repo formats with biome (oxc({ only: ["typecheck"] })), so oxfmt never reformats repo files.
• vite is an auto-installed peer of vitest, and pnpm update --depth Infinity vite left it at 8.0.13. I removed the two locked vite@8.0.13 entries and let pnpm install re-resolve it. That pulled in rolldown 1.2.14 (plus its platform bindings) and @oxc-project/types 0.154.0, which explains most of the lockfile diff. Every new version passed pnpm's minimumReleaseAge: 1440.
• Overrides: none. Changesets: none. No published dependencies or peerDependencies change. The published dists import glob, rimraf, magicast and @pnpm/fs.find-packages as externals (checked after pnpm build), so the fixed versions reach consumers through their own installs.

Maintenance files

.github/
├── dependabot.yml                 # security updates only (open-pull-requests-limit: 0), npm + github-actions at "/", 1-day cooldown, one security group
├── workflows/dependency-audit.yml # Mondays 09:00 UTC + manual: `pnpm audit`, opens/updates/closes a `dependency-audit` issue
└── zizmor.yml                     # dependabot-cooldown: 1 day, matching pnpm's minimumReleaseAge

The README has no CI or security section, so it is unchanged.

The org admin still has to enable the dependency graph and Dependabot security updates for this repo separately. dependabot.yml alone does not turn them on.

Evidence

• Before (main): pnpm audit → 23 vulnerabilities found · Severity: 1 low | 7 moderate | 13 high | 2 critical. The audit step dry-run on main's lockfile prints found=true.
  After: pnpm audit → No known vulnerabilities found. The audit step dry-run (RUNNER_TEMP=$(mktemp -d) GITHUB_OUTPUT=/dev/stdout bash -e -o pipefail -c '<step script>') prints found=false.
• pnpm install --frozen-lockfile, pnpm rr check, pnpm test (18/18 turbo tasks, vitest 4.1.12) and pnpm build (10/10) all pass locally with turbo 2.11.9.
• zizmor==1.30.1 on .github/, offline and online: no findings.

Merge Danger

Door: two-way

Reverting restores the old pins and lockfile. Merging the maintenance files only adds a scheduled workflow and Dependabot config.

Blast Radius: tooling

Only dev tooling versions move in this repo. Published packages get no new manifest content, and their runtime dist output is byte-identical to main. The one dist difference is in @rrlab/cli: its build also compiles src/lib/**/__tests__ and inlines the vitest runtime into a dist/test.*.mjs chunk, which now carries vitest 4.1.12 instead of 4.1.6. Only the shipped test files import that chunk, and it has no @vitest/mocker code, so no changeset is needed. run-run/oxc-plugin/package.json and pnpm-lock.yaml also change in #269 (oxlint-tsgolint, a few lines below the oxfmt line), so whichever PR merges second needs a rebase.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TkHa1BVnm277qEiEuipG6n

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5b70d92

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vland-bot]

Preview release

Latest commit: 5b70d92

Some packages have been released:

Package	Version	Install
@rrlab/oxc-plugin	1.1.5-git-5b70d92.0	@rrlab/oxc-plugin@1.1.5-git-5b70d92.0

Note

Use the PR number as tag to install any package. For instance:

pnpm add @rrlab/oxc-plugin@pr-273