* fix(deps): patch critical Dependabot advisories
Resolve all open critical-severity Dependabot alerts:
- golang.org/x/crypto 0.51.0 -> 0.52.0 (CVE-2026-39830/39831/39832/
39833/39834/42508/46595, GHSA ssh agent/key-constraint bypass, DoS)
- vitest ^1.6.0 -> ^4.1.10 in apps/cli (CVE-2026-47429; aligns with
apps/web, dedupes the lockfile to a single vitest 4.1.10)
- tar ^7.5.11 -> ^7.5.19 in apps/cli (CVE-2026-59873 parse DoS;
resolves to 7.5.21)
Backend builds and vets clean; all 280 apps/cli tests pass on vitest 4.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(cli): bump esbuild to a Vite-8-supported range
The vitest 4 bump pulls vite@8, whose esbuild peer is ^0.27||^0.28,
but the CLI still pinned esbuild ^0.24.0 — pnpm resolved an
unsupported vite/esbuild pair (esbuild@0.24.2) for the CLI test
stack. Bump to ^0.27.0 so vite@8 resolves against esbuild@0.27.2 and
the peer warning clears. CLI tests still pass (280/280).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
João Salavisa
ed33c7ea3f