fix: bump vite to 7.3.5 to resolve GHSA-fx2h-pf6j-xcff

[mishushakov]

Resolves Dependabot alert #185 (CVE-2026-53571 / GHSA-fx2h-pf6j-xcff), a high-severity server.fs.deny bypass in the vite dev server on Windows. Bumps vite from 7.3.2 to 7.3.5, the first patched version, in pnpm-lock.yaml — vite is a transitive dev dependency pulled in via vitest in js/. Lockfile-only change; verified with pnpm install --frozen-lockfile and a vitest smoke check.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Dev-only transitive dependency patch with no runtime or application code changes; residual risk is limited to local vitest/vite tooling behavior.

Overview
Updates pnpm-lock.yaml so vite resolves to 7.3.5 instead of 7.3.2 (still pulled in through vitest in js/). This addresses GHSA-fx2h-pf6j-xcff / CVE-2026-53571, a Windows dev-server path restriction bypass. No application source changes; only the lockfile.

^{Reviewed by Cursor Bugbot for commit c0ed29a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

LGTM — lockfile-only dev dependency bump, no application code changes.

What was reviewed: confirmed the diff is limited to pnpm-lock.yaml, with vite resolving to 7.3.5 everywhere it's referenced (top-level vitest entry, package resolution block, and all snapshot dependency entries). Checked that the integrity hash was updated alongside the version bump and that no other packages' resolutions were touched. Vite is a transitive devDependency (via vitest) used only for local test tooling, not shipped in any runtime path, so blast radius is minimal.

Extended reasoning...

Overview

Single-file, lockfile-only change to pnpm-lock.yaml in the js/ workspace. Bumps vite from 7.3.2 to 7.3.5 (patched version) to resolve GHSA-fx2h-pf6j-xcff, a Windows-only vite dev-server path-restriction bypass. Vite is pulled in transitively through vitest's devDependency tree — there is no direct dependency on vite in package.json, and no application source files are touched.

Security risks

None introduced. This is itself a security fix — it patches a CVE in a dev-only tool. The vulnerability being fixed (server.fs.deny bypass) only affects the vite dev server on Windows, which is not part of the shipped application or CI runtime paths for this repo. No auth, crypto, or permission-sensitive code is touched.

Level of scrutiny

Minimal scrutiny warranted. This is a mechanical, automated-style dependency bump confined entirely to the lockfile: the version and integrity hash are updated consistently across the single top-level reference, the packages block, and all snapshot/resolution entries for vite, @vitest/mocker, and vitest. There is no ambiguity or design decision involved.

Other factors

No CODEOWNER-sensitive paths are touched (pnpm-lock.yaml). Cursor Bugbot's automated review independently rated this Low Risk with the same conclusion. No outstanding review comments to address.