build(deps): clear cli/ npm advisories (postcss, vite, esbuild)

[rsharath]

Summary

Closes the three remaining MEDIUM npm-side Dependabot alerts on cli/package-lock.json:

Severity	Package	Before → After	Advisory
MEDIUM	postcss	8.5.8 → 8.5.14	XSS via unescaped </style> (GHSA-qx2v-qp2m-jg93)
MEDIUM	vite	5.4.21 → 6.4.2	Dev-server arbitrary-request → response leak (GHSA-4w7w-66w2-5vf9)
MEDIUM	esbuild	0.21.5 → 0.25.12	Dev-server CORS bypass (GHSA-67mh-4wv8-2f99)

Pure dependency-manifest update — two files touched (cli/package.json, cli/package-lock.json), no src changes.

Approach

• vitest direct bump: ^2 → ^3. vitest@3 still allows vite ^5 || ^6 || ^7 as a peer; the override below pins the resolution to v6. Going to vitest@3 instead of vitest@4 keeps this a single major jump rather than two — the CLI's 101 tests use only describe/it/expect/beforeEach/vi.fn, none of which see breaking changes between v2 and v3.
• npm overrides in package.json:
  • vite: ^6.4.2 — forces vitest@3's transitive vite up from v5 (the vulnerable line) to v6.4.2+. Pulls a safe esbuild as a side effect (vite@6.4.2 ships with esbuild@0.25.12, well past the 0.24.2 advisory ceiling).
  • postcss: ^8.5.10 — forces both tsup's (via postcss-load-config) and vite's transitive postcss onto the fixed line. Without it, tsup resolves to postcss@8.5.8.

esbuild does not need its own override entry — bumping vite already lifts it past the advisory.

Final resolved tree:

vitest@3.2.4
└── vite@6.4.2
    ├── esbuild@0.25.12
    └── postcss@8.5.14
tsup@8.5.1
├── esbuild@0.27.4
└── postcss@8.5.14

Scope

• cli/package.json + cli/package-lock.json only.
• Independent of build(deps): upgrade lestrrat-go/jwx v2 → v4 + Go 1.26 #114 (jwx v4) and build(deps): bump pgdriver, mapstructure, testcontainers + currency refresh #115 (Go-side deps) — both of those are Go-only; this is npm-only.

Test plan

• npm install — clean install, 0 vulnerabilities.
• npm test (vitest run) — 101/101 passing (~590ms).
• npm run typecheck (tsc --noEmit) — clean.
• npm run build (tsup) — ESM + .d.ts artifacts produced.
• npm run lint (eslint) — clean.
• npm audit — 0 vulnerabilities found.

After merge

Three of the eight outstanding default-branch Dependabot alerts will close. The remaining five are the four already addressed by #115 (mapstructure ×2, pgdriver, plus auto-clear once that PR merges) and the one HIGH docker/docker advisory documented in #115 as unactionable via go get.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vitest@​2.1.9 ⏵ 3.2.4

View full report

[gemini-code-assist]

Code Review

This pull request upgrades the testing framework vitest from version 2 to version 3 and updates its associated ecosystem. Key changes include upgrading vite to version 6 and postcss to version 8.5.14 via package overrides to ensure compatibility and security. The update also involves a significant refresh of internal dependencies such as esbuild, pathe, and various @vitest utility packages, while introducing new type definitions and helper libraries. Node.js engine requirements for several build tools have been bumped to version 18 or higher. I have no feedback to provide.