chore(deps): clear vite advisories, align Dependabot with pnpm release-age gate, pin lint toolchain

[AndrianBdn]

Four dependency-hygiene fixes. The weekly Dependabot run has been failing outright or landing incomplete PRs, and a transitive dev dependency has been sitting on five open advisories with nothing in the repo capable of bumping it.

Split into two commits so the security-relevant change can be reverted on its own.

1. vite 8.0.0 → 8.2.1 (fix(deps))

pnpm-lock.yaml pinned vite@8.0.0, in the vulnerable range of five open advisories — including the one an external scanner flagged, "Arbitrary File Read via Vite Dev Server WebSocket":

#	sev	advisory	vulnerable	patched
62	high	Arbitrary file read via dev server WebSocket	≤ 8.0.4	8.0.5
63	high	server.fs.deny bypassed with queries	≤ 8.0.4	8.0.5
64	med	Path traversal in optimized deps .map	≤ 8.0.4	8.0.5
67	high	server.fs.deny bypass on Windows alt paths	≤ 8.0.15	8.0.16
68	med	launch-editor NTLMv2 disclosure (Windows)	≤ 8.0.15	8.0.16

None are exploitable here. All require a listening Vite dev server; vitest run uses vite purely as an in-process transform pipeline and never opens a socket. It's dev-only, and files publishes just build/**, so consumers never receive it. This is noise reduction, not an incident.

All five were dismissed on GitHub on 2026-08-04 as fix_started — a "working on it" dismissal that was never followed by a fix, which is why GitHub went quiet while external scanners kept flagging it.

Why it went stale is structural and worth fixing. Dependabot runs with dependency-type: direct and update-subdependencies: false, and vite is an auto-installed peer of vitest — so the all-dependencies: '*' group never matched it. Nothing in this repo would ever have bumped vite. pnpm update vite and pnpm dedupe both no-op on it for the same reason; only declaring it directly puts it back under Dependabot's control. The same gap applies to every transitive dep.

A pnpm dedupe in the same commit also drops a duplicate brace-expansion@5.0.7 — itself vulnerable to two open high-severity DoS advisories (#71/#72, fixed in 5.0.8/5.0.9) and pulled in via eslint. Only the already-present 5.0.9 copy remains.

Full resolution delta:

- brace-expansion@5.0.7      (vulnerable duplicate, removed)
- minimatch@10.2.5           (deduped)
- tinyexec@1.2.4             (deduped)
- tslib@2.8.1                (removed)
  rolldown  1.0.0-rc.9 -> 1.2.4
  vite      8.0.0      -> 8.2.1

8.2.2 is current but under 7 days old, so minimumReleaseAge lands us on 8.2.1 — past every patch above.

2. Dependabot + toolchain pinning (chore(ci))

cooldown: default-days: 8. pnpm-workspace.yaml sets minimumReleaseAge: 10080 (7 days), but Dependabot proposes releases the day they ship, so its pnpm job aborts:

[ERR_PNPM_NO_MATURE_MATCHING_VERSION] Version 17.11.0 (released 5 days ago)
of globals does not meet the minimumReleaseAge constraint

This killed the npm job on 2026-08-10 and 2026-08-17. It's not just noise — it aborts mid-group, which is why #89 landed with 4 of ~8 available bumps and gave no sign the rest were dropped. A cooldown just above the pnpm gate stops Dependabot proposing versions pnpm will refuse.

Ignore the typescript major. typescript-eslint hard-throws on TS ≥ 7:

if (versionMajor >= 7) { throw new Error('typescript-eslint does not support TS 7.0.') }

No released version unblocks it — latest is 8.67.0, there is no 9.x, and they're explicitly targeting TS ≥ 7.1, skipping 7.0 (typescript-eslint#10940, still open). TS 7.0 is designed to run side-by-side with 6.0 for exactly this reason. TS 7's headline benefit is compile speed, and pnpm typecheck here takes ~5s — so the upgrade would cost us the linter and buy nothing. Delete the rule when 7.1 support ships.

Exact-pin eslint / prettier / typescript-eslint. These had drifted badly — prettier: ^3.4.2 was resolving to 3.9.6, five minors ahead of what package.json claimed. That invisible drift is the root cause dependabot-autoformat.yml exists to paper over. Pinned at the versions already in the lockfile, so no package version changes — only the recorded specifiers.

The autoformat workflow is kept: an explicit bump of one of these three can still reformat, and Dependabot still won't run project scripts. Its header comment is updated to describe that narrower role.

Verification

• pnpm install --frozen-lockfile clean on both commits independently
• pnpm check (typecheck + lint + format) passes
• 514 tests passing across 46 files
• pnpm build + CLI smoke test pass