[gilesknap]

This updates pnpm-lock.yaml and dev/pnpm-lock.yaml to close 22 of the 24 open Dependabot alerts. It is lockfile-only: everything stays inside the existing ranges and the minimumReleaseAge policy, and no manifest or config changed.

Changes

• Root lock: vitest and @vitest/* 4.1.11 → 4.1.12, vite 8.2.2 → 8.2.4, markdown-it 14.3.0 → 14.3.3, serialize-javascript 7.1.0 → 7.1.4, source-map-js, postcss-selector-parser
• dev/ lock: vite 8.3.2 → 8.3.5 (with rolldown 1.2.16). This also brings its vite specifier back in line with dev/package.json, so the frozen install there works again.

Note: I couldn't use pnpm update on the root lock, because the trustPolicy: no-downgrade setting stops any re-resolution at semver@6.3.1. That started when the semver: ^7.7.4 override was removed in 6cca111. Instead, a small script swapped each version and its registry integrity hash, and a frozen install verified the result. Restoring that override (or adding a trustPolicyExclude) would let pnpm and Dependabot re-resolve again.

Checked
The CI steps pass: pnpm audit --prod, lint, tests (363 passed) and build. lint:tsc, storybook:build and the dev/ build pass too.

Not fixed

• webpack-dev-middleware (1): the fix needs 7.x, but @storybook/builder-webpack5 still declares ^6.1.2.
• deepmerge (1): there is no patched release.

Happy for you to close this if you'd rather handle it via Renovate/Dependabot.

Prepared with Claude Code for @gilesknap; reviewed before opening.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Uybqz7SRaVuiGbQ8Kv6ZHL

[gilesknap]

A better long-term fix: since the semver: ^7.7.4 override was removed in 6cca111, trustPolicy: no-downgrade makes any re-resolution of the root lock fail (ERR_PNPM_TRUST_DOWNGRADE), which also blocks Dependabot's own npm updates. Restoring that override, or adding a reviewed trustPolicyExclude, and adding a frozen install of dev/ to CI would let the bots keep both locks current.