🔒 fix: Upgrade Vulnerable Medium Severity Dependencies

[dustinhealy]

Summary

Upgrade the admin panel's remaining Medium-severity dependency findings to patched releases. The lockfile now resolves patched versions of axios, h3, katex, lodash, lodash-es, moment, mongoose, nanoid, picomatch, postcss, source-map-js, undici, vite, ws, and yaml.

Root overrides cover transitive dependencies, and direct peer declarations keep lodash and mongoose on patched versions. A coordinated TanStack Start patch carries the fixed h3 alias while preserving the production build.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• bun install --frozen-lockfile
• bunx tsc --noEmit
• bun run test — 27 files, 1,215 tests passed
• bun run build — client and server bundles built
• Built server smoke test — /health and / returned 200; browser sign-in, Configuration load, and session reload succeeded
• git diff --check
• Audited all 15 target package resolutions in bun.lock
• Legacy glob-consumer smoke test — micromatch, anymatch, and readdirp matched a sample TypeScript file with the patched picomatch override
• bun -e 'import katex from "katex"; if (!katex.renderToString("x^2").includes("katex")) process.exit(1)'

Areas to test manually

• Sign-in and navigation: sign in, reload, and visit Dashboard, Configuration, Access, Grants, and Help. This exercises the TanStack Start and h3 server paths.
• Configuration: load existing settings, validate a YAML import, save a reversible setting change, reload, and restore the original value.
• Development workflow: start the Vite dev server and verify the page loads and refreshes after a local source edit. This exercises Vite, PostCSS, and glob matching.
• Rendered content: check any math or Markdown content available in the panel, because the transitive KaTeX version changes.

The picomatch override also reaches older transitive consumers; the dev-server and build checks are particularly relevant to that compatibility path.

Manual test results

• Signed in, reloaded, and opened Dashboard, Configuration, Access, Grants, and Help.
• Valid nested YAML reached the import-target preview; the preview was canceled without applying it. Malformed YAML produced a line-and-column syntax error.
• Saved a temporary configuration override, confirmed it survived reload, then removed it. Another reload confirmed the original unset state.
• Started the Vite dev server, touched a source file, observed client hot update and server reload, and confirmed the dashboard remained usable.
• Started the built production server locally, signed in, loaded Configuration, and reloaded with the session intact.
• Confirmed legacy glob consumers (micromatch, anymatch, and readdirp) still match expected files.
• The panel exposes no math-rendering control in its current UI. KaTeX was smoke-tested directly with renderToString.

Test Configuration:

Bun 1.3.3 and the admin panel's standard local test/build commands. Browser checks used local development and production builds.

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• Local unit tests pass with my changes