chore(client): clear 11 devtime advisories via transitive overrides

[Detair]

Summary

Reduces client bun audit from 17 advisories (10 high, 7 moderate) to 6 (3 unique CVEs, all dev-server only) by adding package.json overrides for transitive devtime dependencies.

11 of 17 advisories cleared. The remaining 3 unique CVEs are all in vite@7.3.1 (nested via vitest@4.1.0 > @vitest/mocker > vite), affect only the dev server, and are documented as accepted exceptions below.

Overrides applied

"overrides": {
  "picomatch": "^4.0.4",
  "rollup": "^4.60.1",
  "flatted": "^3.4.2",
  "brace-expansion": "^1.1.13",
  "lodash-es": "^4.17.24",
  "defu": "^6.1.5"
}

Each clears one or more advisories. Notably, rollup is NOT a no-op — even though this project uses rolldown-vite, @rollup/plugin-commonjs still has a nested rollup that's patched by the override.

Why no vite override

Tested vite: 8.0.0 through vite: 8.0.8 — all fail tests with "Failed to parse source for import analysis" on Toast.tsx. Root cause: vitest@4.1.0 bundles a nested vite@7.3.1 via @vitest/mocker. When bun applies a vite override globally, both the direct vite and the nested one resolve to the same version — and @vitest/mocker@4.1.0's internal API is incompatible with vite 8.x in the nested slot.

Bun 1.3.9 does not support scoped overrides ("vitest>vite": "..."), so we cannot patch only one.

Accepted exceptions (3 unique CVEs, 6 raw reports)

All three are in nested vite@7.3.1 via vitest > @vitest/mocker > vite. All three require a developer to run bun run dev AND visit a malicious URL in their browser. None affect production builds (bun run build uses rolldown-vite's build path, not the dev server).

CVE	Severity	Description
GHSA-4w7w-66w2-5vf9	moderate	Vite Path Traversal in Optimized Deps .map handling
GHSA-v2wj-q39q-566r	high	Vite server.fs.deny bypassed with queries
GHSA-p9ff-h696-f583	high	Vite Arbitrary File Read via Dev Server WebSocket

Exploitation path: dev-server only. Developer runs bun run dev, malicious URL is visited in the dev server's browser tab, attacker gets file read / path traversal. Production is unaffected.

Developer detection: CI bun audit still reports these (we don't suppress them). A future vitest bump that drops the nested vite pin will auto-clear them.

Why not fix now: would require bumping vitest + vite-plugin-solid in lockstep, which is Plan B scope and out of this PR's scope.

Mermaid load mode

Confirmed lazy-loaded: client/src/components/pages/MarkdownPreview.tsx:21 uses await import("mermaid") inside loadMermaid(). The lodash-es runtime exposure (via mermaid > dagre-d3-es) only triggers when a user views a markdown block that renders a mermaid diagram. The lodash-es ^4.17.24 override still applies for defense in depth.

Test plan

• bun install — 504 packages, clean
• bun audit — 6 (was 17), all 3 unique CVEs documented above
• bun run test:run — 577/577 passing
• bun run build — succeeds
• CHANGELOG.md — Security entry added
• CI Frontend job passes

Refs

• Spec: docs/superpowers/specs/2026-04-11-security-audit-followups-design.md (Topic 1)
• Plan: docs/superpowers/plans/2026-04-11-client-devtime-advisories.md
• Earlier failed attempt: fix(security): audit follow-up — advisory ignores, client dep patches, cleanup #513 (hit a bun worktree-resolution bug — this branch was created directly off main, not via git worktree add, to avoid that bug)

🤖 Generated with Claude Code