[innrvoice]

The development toolchain locks vulnerable versions of nine packages reported by Dependabot, including Vitest Browser Mode file-access bugs, PostCSS source map disclosure and Undici HTTP handling issues. Update their resolved versions and raise the existing Undici/PostCSS overrides so fresh installs use patched dependencies.

The current advisory floors are higher than those in the email digest. npm audit also reports additional vulnerabilities in the same packages, so the update covers those fixes too.

Package	Resolved version
undici	7.29.1 for the existing Actions overrides; 7.30.0 under jsdom
brace-expansion	5.0.12
postcss	8.5.23
nanoid	3.3.19
browserslist	4.29.2
baseline-browser-mapping	2.11.26
vitest, @vitest/browser, @vitest/mocker	4.1.11

Align @vitest/browser-playwright and @vitest/coverage-v8 at 4.1.11 to preserve their exact peer requirements. Refresh compatible transitive dependencies without adding packages or changing the library API, React peer range or application source.

Validation:

• pnpm install --frozen-lockfile, git diff --check, pnpm lint and pnpm format:check: passed.
• pnpm audit: 36 vulnerabilities before the update, 0 afterward. A separate lockfile version check covers every resolved copy of all nine affected packages.
• CI=true pnpm test:coverage:unit: 136 tests passed; 99.49% line coverage.
• CI=true pnpm test:storybook: 20 tests passed in Chromium.
• pnpm build, pnpm test:package-smoke, pnpm test:react-compat, pnpm test:react-compat:matrix and CI=true pnpm build:sb: passed, including React 16, 17, 18 and 19 smoke checks.
• Focused before/after security checks: Undici degenerate private cache directives no longer crash or remain cacheable; brace-expansion completes the previously timing-out non-expanding group input; PostCSS rejects mocked absolute and traversal source map reads with and without from. Ordinary cache parsing, brace expansion and explicit/adjacent source maps still work.

The focused reproductions cover representative advisories. Remaining version-based findings are verified through the complete lockfile check and audit rather than individual exploit reproductions. Dependabot will re-evaluate the default branch after merge.

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!