chore: refresh runtime audit lockfile

[dutchaiagency]

Summary

• Refreshes package-lock.json with non-breaking runtime audit fixes from npm audit fix --omit=dev --package-lock-only.
• Updates locked runtime packages including react-router-dom / react-router, @remix-run/router, lodash, postcss, preact, picomatch, minimatch, brace-expansion, yaml, and related transitive entries.
• Leaves the remaining streamdown / mermaid / uuid audit item untouched because npm marks that path as requiring --force and a breaking streamdown downgrade.

Validation

• npm ci
• npm run typecheck
• npm run lint (passes with existing warnings only)
• npm run build
• npm audit --omit=dev --audit-level=moderate now reports only the breaking-change streamdown/mermaid/uuid path

---

Note

Medium Risk
Updates several runtime dependency versions via lockfile-only changes, which can subtly affect routing/build output at runtime despite being patch/minor bumps. No application code changes, but dependency resolution changes warrant a smoke test of navigation and CSS processing.

Overview
Refreshes package-lock.json (lockfile-only) to apply npm audit fix --omit=dev updates.

Bumps locked runtime packages including react-router-dom/react-router (and @remix-run/router), lodash, postcss, preact, minimatch/brace-expansion, picomatch, glob, uuid, and yaml, plus related transitive metadata (e.g., added license/funding fields).

^{Reviewed by Cursor Bugbot for commit 6222fa9. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Refreshes the runtime package-lock.json with non-breaking security updates to reduce audit noise without changing app code. npm audit at moderate now only reports the known streamdown/mermaid/uuid path.

• Dependencies
  • Ran npm audit fix --omit=dev --package-lock-only (runtime only, lockfile-only).
  • Key bumps: react-router-dom 6.30.3, react-router 6.30.3, @remix-run/router 1.23.2, lodash 4.18.1, postcss 8.5.13, preact 10.29.1, picomatch 2.3.2, minimatch 9.0.9, brace-expansion 2.1.0, yaml 2.8.4, uuid 11.1.1 (plus transitive updates).
  • Left streamdown/mermaid/uuid vulnerability unresolved since it requires --force and a breaking downgrade; build, typecheck, and lint still pass.

^{Written for commit 6222fa9. Summary will update on new commits.}

[vercel]

@dutchaiagency is attempting to deploy a commit to the Adam Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

No issues found across 1 file