fix(security): patch critical/high CVEs and migrate pnpm settings

[llbbl]

Summary

• Patched critical/high CVEs via direct upgrades and pnpm overrides
• Migrated pnpm configuration from package.json to pnpm-workspace.yaml (required for pnpm 10+)
• Bumped Docker base image to node:22-slim to satisfy Astro 6's Node ≥22.12 requirement

Changes

Security

• CVE patches: Upgraded sanitize-html (xmp XSS, critical) and @vitest/browser (otelCarrier, critical)
• protobufjs chain: Addressed critical+high chain in protobufjs (transitive via @xenova/transformers)
• pnpm overrides: Added overrides for rollup, picomatch, postcss, ws, devalue, protobufjs, and @protobufjs/utf8 to clear remaining transitive high/moderate vulnerabilities

pnpm Configuration

• pnpm-workspace.yaml: Migrated pnpm settings field out of package.json into new pnpm-workspace.yaml — pnpm 10+ no longer reads this field from package.json; settings were previously silently ignored

Docker

• Dockerfile: Bumped base image from node:20-slim to node:22-slim — Astro 6 requires Node ≥22.12, so the production Docker build was broken on the old base
• Dockerfile: Added pnpm-workspace.yaml to COPY in both the build and runtime stages so pnpm settings are applied during image builds

Test plan

• pnpm test — 152/152 passing
• pnpm exec tsc --noEmit — no type errors
• pnpm build — production build succeeds
• docker build -f Dockerfile.local . — image builds successfully
• Indexer runtime — content indexing works end-to-end

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​ui@​4.1.8
	@​vitest/​browser@​4.1.8
	vitest@​4.1.8
	@​vitest/​coverage-v8@​4.1.8
	@​astrojs/​react@​5.0.7
	sanitize-html@​2.17.4

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.33%. Comparing base (478259f) to head (a065568).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #64   +/-   ##
=======================================
  Coverage   83.33%   83.33%           
=======================================
  Files          11       11           
  Lines         264      264           
  Branches       68       68           
=======================================
  Hits          220      220           
  Misses         26       26           
  Partials       18       18           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.