🔒 fix: upgrade vulnerable low severity build dependencies

[AtefBellaaj]

Summary

Upgrades the three remaining Low-severity transitive build dependency findings reported by Mend SCA against this repository's dependency tree: @babel/core, browserslist, and baseline-browser-mapping. All three are pulled in only through the build toolchain (@babel/core → browserslist → baseline-browser-mapping), not through any runtime chain. form-data is the fourth Low finding and already resolves to the patched 4.0.6 on main, so no change is needed for it here.

Pins are added as package.json overrides (not lockfile-only bumps) so they survive future bun install runs and lockfile regeneration, mirroring the approach already used for the Medium-severity findings in #157.

This PR is stacked on #157 (fix/security-medium-deps) and targets that branch as its base. It should be merged after #157, then retargeted to main (GitHub does this automatically once the base branch is deleted, otherwise via gh pr edit --base main).

Supersedes #155.

Change Type

Please delete any irrelevant options.

• Bug fix (non-breaking change which fixes an issue)

Testing

All commands run from a clean worktree based on this branch, using bun only (no npm/pnpm/yarn, no package-lock.json/pnpm-lock.yaml created).

bun install                     # regenerates bun.lock
bun install --frozen-lockfile   # succeeds
bun run lint                    # eslint src/ — 0 errors
bunx tsc --noEmit               # 0 errors
bun run test                    # vitest run — 27 files, 1215 tests, all passed
bun run build                   # vite build (client + ssr) — succeeds

Server smoke test:

PORT=3100 SESSION_SECRET=<36+ char secret> bun server.ts
curl -s -o /dev/null -w '%{http_code}' localhost:3100/health   # 200
curl -s -o /dev/null -w '%{http_code}' localhost:3100/         # 200

Server was killed after the check; no leftover process remained (verified with ps and lsof -i :3100).

Babel / browserslist smoke tests:

• bun -e importing @babel/core and transforming const a = 1; → returned the expected transformed code ("const a = 1;").
• bun -e importing browserslist and querying defaults → returned a non-empty array (32 entries).

Lockfile audit (python3 -I script that strips bun.lock's trailing commas, parses the JSONC, and reports every resolved version per package):

Package	Resolved version(s)	Expected
@babel/core	7.29.6	7.29.6 only
browserslist	4.28.7	4.28.7 only
baseline-browser-mapping	2.11.0	2.11.0 only
form-data	4.0.6	4.0.6 (already patched)
h3 (PR 1 target, unchanged)	2.0.1-rc.20	2.0.1-rc.20 only
vite (PR 1 target, unchanged)	8.0.16	8.0.16 only
picomatch (PR 1 target, unchanged)	4.0.4	4.0.4 only
nanoid (PR 1 target, unchanged)	3.3.18	3.3.18 only
postcss (PR 1 target, unchanged)	8.5.23	8.5.23 only

Test Configuration:

• bun --version: 1.4.2
• OS: macOS 26.7.1 (Darwin 25.6.0, arm64)

Checklist

Please delete any irrelevant options.

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• My changes do not introduce new warnings
• Local unit tests pass with my changes