fix(deps): patch vite (high) + esbuild dev-server advisories in the pnpm workspace

[ardelperal]

Context

GitHub Dependabot reports 4 open advisories on the default branch, all in a pnpm-lock.yaml (the pnpm workspace — site/ Astro docs and/or telemetry-worker/, not the root npm package-lock.json). All are dev/build-time dependencies (Vite + esbuild dev servers), so they do not ship in the published CLI runtime — but they should still be patched to clear the alerts and protect contributors running the dev servers locally.

Advisories

Severity	Package	Vulnerable	First patched	Advisory	Summary
High	vite	<= 6.4.2	6.4.3	GHSA-fx2h-pf6j-xcff	server.fs.deny bypass on Windows alternate paths
Medium	vite	<= 6.4.2	6.4.3	GHSA-v6wh-96g9-6wx3	launch-editor: NTLMv2 hash disclosure via UNC path on Windows
Medium	vite	<= 6.4.1	6.4.2	GHSA-4w7w-66w2-5vf9	Path traversal in optimized-deps .map handling
Medium	esbuild	<= 0.24.2	0.25.0	GHSA-67mh-4wv8-2f99	Dev server allows any website to send requests and read the response

All four collapse into two bumps: vite → >= 6.4.3 (covers the three Vite advisories) and esbuild → >= 0.25.0.

Proposed Approach

1. Locate the affected manifest(s): git grep -l "" -- '**/pnpm-lock.yaml' and check which workspace(s) resolve vite/esbuild (likely site/ and/or telemetry-worker/). Both may be transitive (e.g. esbuild under vite/wrangler, vite under @astrojs/starlight).
2. For direct deps: bump the version range in the relevant package.json (vite → ^6.4.3, esbuild → ^0.25.0) and refresh the lockfile with pnpm install in that workspace only.
3. For transitive deps: use a pnpm override to force the resolved version, e.g. in the workspace package.json:

   { "pnpm": { "overrides": { "vite@<6.4.3": ">=6.4.3", "esbuild@<0.25.0": ">=0.25.0" } } }

   then pnpm install to update the lockfile.
4. Verify the affected dev tooling still builds/runs (the docs site build, the telemetry worker build).
5. Keep the root npm project (package-lock.json) untouched unless it is also flagged — the alerts name pnpm-lock.yaml only.

Acceptance Criteria

• All 4 Dependabot alerts (numbers 2, 3, 5, 6) are resolved/auto-dismissed after the lockfile update lands on main.
• vite resolves to >= 6.4.3 and esbuild to >= 0.25.0 everywhere in the affected pnpm-lock.yaml.
• The affected workspace still builds (docs site / telemetry worker — run whatever build script each defines).
• No change to the root npm project unless it is independently flagged.
• gh api repos/ardelperal/codegraph/dependabot/alerts --jq '[.[]|select(.state=="open")]|length' returns 0 for these (or only unrelated new alerts remain).

Verification

# after the change is merged to main:
gh api repos/ardelperal/codegraph/dependabot/alerts \
  --jq '[.[] | select(.state=="open") | {num:.number, pkg:.dependency.package.name, sev:.security_advisory.severity}]'
# expect: vite/esbuild entries gone

Notes / Risk

• Real-world exposure is low for the published product: these are dev-server / build-tool advisories, not runtime code paths in the shipped CLI. Priority is "keep the tree clean + protect contributors", not an emergency.
• The Windows-specific advisories (fs.deny bypass, NTLMv2 disclosure) matter most to contributors developing on Windows, which is a first-class platform for this repo.

[ardelperal]

Resolved by #100 (merged to main). All 4 alerts (#2/#3/#5/#6) are now fixed, 0 open Dependabot alerts.

Note: the vulnerable vite/esbuild were transitive (via vitest) in the root pnpm-lock.yaml — this fork runs pnpm at the root, there is no separate site//telemetry-worker/ workspace. Fixed exactly as proposed here: pnpm.overrides forcing esbuild>=0.25.0 and vite>=6.4.3 <8 (the <8 keeps it within vitest 3.2.6's peer range). Resolves to vite@7.3.6 / esbuild@0.28.1.