Add Dependabot config, audit CI job, and resolve all audit vulnerabilities

.github/dependabot.yml

@@ -0,0 +1,44 @@
+version: 2
+updates:
+  # pnpm dependencies (Dependabot uses "npm" ecosystem for npm/yarn/pnpm)
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    versioning-strategy: increase
+    open-pull-requests-limit: 10
+    groups:
+      dev-dependencies:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+      production-dependencies:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directory: /packages/react-web-cli
+    schedule:
+      interval: weekly
+    versioning-strategy: increase
+    open-pull-requests-limit: 10
+    groups:
+      dev-dependencies:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+      production-dependencies:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/audit.yml

@@ -0,0 +1,33 @@
+name: Security Audit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 10
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run security audit
+        run: pnpm audit

package.json

@@ -112,10 +112,10 @@
   "dependencies": {
     "@ably/chat": "^1.3.1",
     "@ably/spaces": "^0.4.0",
-    "@inquirer/prompts": "^5.1.3",
+    "@inquirer/prompts": "^5.5.0",
     "@oclif/core": "^4.2.10",
     "@oclif/plugin-autocomplete": "^3.2.30",
-    "@oclif/plugin-warn-if-update-available": "^3.1.41",
+    "@oclif/plugin-warn-if-update-available": "^3.1.57",
     "@xterm/addon-fit": "^0.10.0",
     "@xterm/addon-web-links": "^0.11.0",
     "@xterm/xterm": "^5.5.0",
@@ -131,7 +131,7 @@
     "ora": "^8.2.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "smol-toml": "^1.5.2",
+    "smol-toml": "^1.6.1",
     "ws": "^8.16.0",
     "zod": "^3.24.2"
   },
@@ -148,14 +148,14 @@
     "@types/react-dom": "^18.3.5",
     "@types/uuid": "^10.0.0",
     "@types/ws": "^8.5.11",
-    "@typescript-eslint/eslint-plugin": "^8.41.0",
-    "@typescript-eslint/parser": "^8.41.0",
-    "@vitest/coverage-v8": "^4.0.0",
-    "@vitest/eslint-plugin": "^1.5",
-    "@vitest/ui": "^4.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.57.2",
+    "@typescript-eslint/parser": "^8.57.2",
+    "@vitest/coverage-v8": "^4.1.2",
+    "@vitest/eslint-plugin": "^1.6.13",
+    "@vitest/ui": "^4.1.2",
     "dotenv": "^16.5.0",
-    "eslint": "^9.34.0",
-    "eslint-config-oclif": "^6.0.44",
+    "eslint": "^9.39.4",
+    "eslint-config-oclif": "^6.0.153",
     "eslint-config-prettier": "^10.1.2",
     "eslint-plugin-n": "^17.17.0",
     "eslint-plugin-prettier": "^5.2.6",
@@ -167,16 +167,16 @@
     "http-server": "^14.1.1",
     "nock": "^14.0.3",
     "node-pty": "^1.0.0",
-    "oclif": "^4.2.10",
-    "playwright": "^1.52.0",
+    "oclif": "^4.22.96",
+    "playwright": "^1.58.2",
     "prettier": "^3.5.3",
-    "serve": "^14.2.4",
+    "serve": "^14.2.6",
     "shx": "^0.4",
     "strip-ansi": "^7.1.0",
     "ts-node": "11.0.0-beta.1",
     "typescript": "^5.8.2",
     "uuid": "^11.1.0",
-    "vitest": "^4.0.0"
+    "vitest": "^4.1.2"
   },
   "engines": {
     "node": ">=22.0.0"
@@ -211,9 +211,29 @@
   },
   "pnpm": {
     "overrides": {
-      "brace-expansion@1": "1.1.12",
-      "brace-expansion@2": "2.0.2",
-      "tar-fs": "2.1.3"
+      "brace-expansion@1": "1.1.13",
+      "brace-expansion@2": "2.0.3",
+      "tar-fs": "2.1.3",
+      "minimatch@<3.1.4": "3.1.4",
+      "minimatch@>=9.0.0 <9.0.7": "9.0.7",
+      "minimatch@>=10.0.0 <10.2.3": "10.2.3",
+      "rollup@>=4.0.0 <4.59.0": "4.59.0",
+      "tar@<7.5.11": "7.5.11",
+      "glob@>=10.2.0 <10.5.0": "10.5.0",
+      "qs@<6.14.2": "6.14.2",
+      "diff@<5.2.2": "5.2.2",
+      "tmp@<0.2.4": "0.2.4",
+      "flatted@<3.4.2": "3.4.2",
+      "lodash@<4.17.22": "4.17.23",
+      "vite@>=6.0.0 <6.4.1": "6.4.1",
+      "picomatch@<2.3.2": "2.3.2",
+      "picomatch@>=4.0.0 <4.0.4": "4.0.4",
+      "@eslint/plugin-kit@<0.3.4": "0.3.4",
+      "undici@<6.24.0": "6.24.0",
+      "js-yaml@>=4.0.0 <4.1.1": "4.1.1",
+      "ajv@<6.14.0": "6.14.0",
+      "ajv@>=7.0.0-alpha.0 <8.18.0": "8.18.0",
+      "esbuild@<=0.24.2": "0.25.0"
     }
   }
 }