fix: resolve baseline CI audit vulnerabilities

[luandro]

Summary

Resolves baseline CI audit failure — adds npm overrides for transitive dependencies with vulnerabilities, plus direct version bumps for vitest/*.

Changes

Package	From	To	Fixes
vitest + @vitest/browser	4.1.8	4.1.10	GHSA-p63j-vcc4-9vmv (critical)
fast-uri (transitive)	<3.1.3	≥3.1.4 (override)	GHSA-4c8g-83qw-93j6, GHSA-v2hh-gcrm-f6hx (high)
sharp (transitive)	<0.35.0	≥0.35.3 (override)	GHSA-f88m-g3jw-g9cj (high)
axios	1.x	≥1.18.1 (override)	Multiple high-severity advisories

Also applies Prettier formatting from v3.8.3 → v3.9.6 resolution change.

Verification

• ✅ npm audit --audit-level=high → 0 high/critical vulnerabilities
• ✅ npm test → full suite passes
• ✅ tsc --noEmit → clean
• ✅ ESLint → clean (one pre-existing warning)
• ✅ Prettier → all files formatted
• ✅ All existing scripts unchanged

Related

Unblocks PR #139 and any other PR blocked by the baseline audit failure.

Greptile Summary

Updates vulnerable development and transitive dependencies while preserving the previously reported Storybook CI runner setup.

• Bumps Vitest packages to 4.1.10.
• Adds dependency overrides and regenerates Bun and npm lockfiles.
• Documents and temporarily ignores the stale Bun advisory for the fixed Vitest version.

Confidence Score: 5/5

The PR appears safe to merge because the previously reported Storybook CI runner configuration remains intact and no blocking failure remains.

No blocking failure remains.

T-Rex Logs

What T-Rex did

• Validated the pre-change CI audit behavior, showing that the audit ignored exit code 1 and reported 1 critical plus 6 high findings.
• Validated the after-change CI audit, confirming the exact .github/workflows/ci.yml:511 command with all nine --ignore arguments exits with code 0.
• Captured a reproduction script that records Bun versions, installed-graph versions, lockfile root versions, and the audit command to enable repeatable validation.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
package.json	Adds security-focused overrides and bumps the aligned Vitest packages while retaining the Storybook runner script and dependency.
bun.lock	Resolves the updated Vitest packages and overridden transitive dependencies to the intended versions.
package-lock.json	Regenerates npm dependency resolutions to reflect the manifest updates.
.github/workflows/ci.yml	Adds a documented audit exception for an advisory whose fixed Vitest version is already installed.

_{Reviews (3): Last reviewed commit: "fix: resolve baseline CI audit vulnerabi..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​ui@​4.1.8 ⏵ 4.1.10				+2
	vitest@​4.1.8 ⏵ 4.1.10	+1		+1
	@​vitest/​coverage-v8@​4.1.8 ⏵ 4.1.10				+2
	@​vitest/​browser-playwright@​4.1.8 ⏵ 4.1.10			+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[github-actions]

Preview deployment ready: https://fix-audit-vulnerabilities-20.comapeo-cloud-app.pages.dev

Commit: d9d9c15