fix(deps): resolve dependency audit advisories

[ChiragAgg5k]

What

Dependency audit is red on main: the npm, bun and rust jobs fail, which blocks unrelated PRs such as #364. This PR clears every advisory those jobs report.

Ecosystem	Templates	Fix
bun	sync-with-meilisearch, sync-with-qdrant, whatsapp-with-vonage	bun audit fix: axios 1.19.0 → 1.20.x (via node-appwrite), undici → 6.28.1. Lockfile only
npm	13 templates (undici, qs, fast-uri, @grpc/grpc-js, @fastify/busboy)	npm audit fix. Lockfile only
npm	email-contact-form, password-expiry	nodemailer ^9.0.3 → ^10.0.14, since every release up to 10.0.8 is affected
npm	generate-pdf	@faker-js/faker ^8.4.1 → ^10.6.0 (GHSA-qxc2-j82w-r537, helpers.fake RCE)
cargo	rust/starter	rustls 0.23.40 → 0.23.45 (RUSTSEC-2026-0285). Lockfile only

Test

• npm audit / bun audit / cargo audit pass for every template that the workflow loops over.
• Major bumps were smoke-tested. generate-pdf's generateFakeOrder() runs on faker 10. nodemailer.createTransport().sendMail() works on 10.0.14 (JSON transport) in both templates.
• rust/starter: cargo +1.83.0 check passes, which is the template's rust-version.

[hansi-codes]

🟢 Tier S · Ready to merge

No concrete defects found in the dependency updates or their existing callers.

Updates dependency resolutions across Bun, Node.js, TypeScript, and Rust templates to address audit advisories. Bumps Nodemailer and Faker major versions in three Node templates and updates their documented runtime to Node 22.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 6

File	Change
bun/{sync-with-meilisearch,sync-with-qdrant,whatsapp-with-vonage}/bun.lock	Refreshes dependency resolutions for Axios and Undici advisory fixes.
node-typescript/{discord-command-bot,sync-with-qdrant,whatsapp-with-vonage}/package-lock.json	Refreshes audited transitive dependency resolutions.
node/{analyze-with-perspectiveapi,censor-with-redact,discord-command-bot,generate-with-together-ai,music-generation-with-huggingface,payments-with-stripe,push-notification-with-fcm,subscriptions-with-stripe,sync-with-pinecone,sync-with-qdrant,whatsapp-with-vonage}/package-lock.json	Updates transitive dependencies to patched releases.
node/{email-contact-form,password-expiry}/{package.json,package-lock.json,README.md}	Upgrades Nodemailer to ^10.0.14 with matching lockfiles and documents Node 22.
node/generate-pdf/{package.json,package-lock.json,README.md}	Upgrades Faker to ^10.6.0 with a matching lockfile and documents Node 22.
rust/starter/Cargo.lock	Updates rustls to 0.23.45.

---

_{Reviewed fa94e1b · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟡 Tier B · 1 blocking finding to address. Summary

[ChiragAgg5k]

@hansi-codes review

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary