🔒 fix: upgrade vulnerable medium severity dependencies

[AtefBellaaj]

Summary

Upgrades the 13 remaining Mend SCA Medium-severity transitive dependency findings on main to patched versions: axios, h3, lodash, lodash-es, moment, mongoose, nanoid, picomatch, postcss, source-map-js, undici, vite, ws and yaml. Every finding is transitive, so the fix pins versions via package.json overrides (so the pins survive future bun install runs) and bumps the @tanstack/* family in lock-step so @tanstack/start-server-core carries its patched h3 (aliased internally as h3-v2, so a plain overrides.h3 would not reach it). axios was already fixed on main.

Supersedes #154 (rebuilt on top of #153's js-yaml override, which #154 predates and conflicts with).

Change Type

Please delete any irrelevant options.

• Bug fix (non-breaking change which fixes an issue)

Testing

Commands run from a clean worktree on fix/security-medium-deps (base main @ 9315de9):

Command	Result
bun install	regenerated bun.lock; 798 packages installed
bun install --frozen-lockfile	passed; 13 packages installed, no lockfile changes
bun run lint	passed, 0 errors
bunx tsc --noEmit	passed, 0 errors
bun run test	passed — 27 test files, 1215 tests
bun run build	passed — client + SSR bundles built
SESSION_SECRET=... PORT=3100 bun server.ts then curl /health and curl /	both returned HTTP 200

bun.lock audit

Parsed bun.lock (JSONC, trailing commas stripped) and printed the resolved version(s) for every target package. Each resolves to exactly one version, the patched one:

Package	Resolved version
seroval	1.6.3
yaml	2.8.3
js-yaml	4.3.2
moment	2.31.0
mongoose	8.24.1
lodash	4.18.0
lodash-es	4.18.0
form-data	4.0.6 (already fixed on main)
ws	8.21.0
axios	1.20.0
h3	2.0.1-rc.20 (via @tanstack/start-server-core@1.167.18's h3-v2 alias)
postcss	8.5.23
vite	8.0.16 (no 7.x copies)
undici	7.29.1
picomatch	4.0.4 (no 2.3.x copies)
nanoid	3.3.18
source-map-js	1.2.2
katex	0.18.2
@tanstack/start-server-core	1.167.18
@tanstack/react-start	1.167.30

Confirmed a single hoisted node_modules/picomatch directory (no nested copies), so legacy consumers resolve to the patched version.

Smoke tests

• micromatch (4.0.8), anymatch (3.1.3) and readdirp (3.6.0) — each required directly and matched/scanned a sample .ts path successfully against the overridden picomatch@4.0.4.
• katex.renderToString("x^2") — returned HTML containing katex.

Test Configuration:

• bun 1.4.2
• macOS (Darwin 25.6.0)

Checklist

Please delete any irrelevant options.

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• My changes do not introduce new warnings
• Local unit tests pass with my changes