fix(security): patch JavaScript build and test dependencies

.github/workflows/npm-security.yml

@@ -0,0 +1,26 @@
+name: JavaScript dependency security
+on:
+  pull_request:
+  push:
+    branches: [master]
+permissions:
+  contents: read
+jobs:
+  workspace:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 26.12.1
+      - name: Install pinned pnpm
+        run: npm install --global pnpm@12.15.0
+      - name: Install the locked workspace
+        run: pnpm install --frozen-lockfile
+      - name: Build TypeScript packages and Studio
+        run: pnpm build
+      - name: Test the workspace
+        run: pnpm test
+      - name: Audit all dependencies
+        run: pnpm audit

apps/studio/package.json

@@ -22,7 +22,7 @@
     "@types/react-dom": "^19.1.6",
     "@vitejs/plugin-react": "^4.6.0",
     "typescript": "~5.8.3",
-    "vite": "^7.0.4",
+    "vite": "^7.3.7",
     "@tauri-apps/cli": "^2"
   }
 }

packages/core/package.json

@@ -24,6 +24,6 @@
   "devDependencies": {
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.12"
   }
 }

packages/protocol/package.json

@@ -21,6 +21,6 @@
   },
   "devDependencies": {
     "typescript": "^5.6.0",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.12"
   }
 }