chore(deps): npm audit remediation — clear all critical/high alerts

[patfbridge]

Summary

Follow-up to #173. Clears every remaining critical/high dependabot/npm-audit finding via a lockfile refresh plus three version-floor bumps. No overrides, no semver-major changes, all constraints respected (Prisma stays 6.x, Next stays 16.2.10, next-auth stays beta.30).

package.json changes

• prisma / @prisma/client ^6.19.2 → ^6.19.3 — 6.19.3 ships @prisma/config with effect@3.21.0 (fixes GHSA-38f7-945m-qr2g) and floats defu to 6.1.7 (fixes GHSA-737v-mqg7-c878). Both are build-time-only exposure — @prisma/client has zero runtime deps; this chain only runs in prisma generate/migrate deploy.
• vitest ^4.0.18 → ^4.1.10 — fixes the lone critical (GHSA-5xrq-8626-4rwp, arbitrary file read/execute via the Vitest UI server). This repo never runs --ui/api mode, so real exposure was nil — fixed anyway. Also clears the vite (→8.1.5) / esbuild / picomatch / flatted subtree.

Lockfile-only floats (npm audit fix, all in-range)

• ws 8.19.0 → 8.21.1 (GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx) — pulled in by @supabase/realtime-js but dormant: the app uses Supabase for Storage only, no realtime channels exist.
• minimatch, brace-expansion, ajv, js-yaml, @babel/core, protocol-buffers-schema, root postcss — all dev-toolchain (eslint/typescript-eslint) or theoretical exposure.

Residual after this PR: 3 moderate, wait-for-upstream

next@16.2.10 pins its bundled postcss at 8.4.31 exactly; the fix (GHSA-qx2v-qp2m-jg93, postcss ≥8.5.10) exists only in Next 16.3 canaries so far. Not reachable in this app — all CSS is developer-authored and compiled at build time; no attacker-controlled CSS is ever stringified. next/next-auth moderates are the same chain transitively. Resolves on the next stable Next patch.

Verification

• npm audit: 1 critical / 9 high / 6 moderate / 2 low → 0 critical / 0 high / 3 moderate / 0 low
• vitest run on 4.1.10 — 85/85 pass
• npx prisma generate (6.19.3) + npx next build — succeed, all routes + middleware compile

Once this reaches main, the stale dependabot PRs against main (#25, #111, #116, etc.) should auto-close or become closeable.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Uw3MfeVXbAzNhGfRkmQp5u

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hop-aboard	Ready	Preview, Comment	Jul 16, 2026 8:45pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9e9db599-eafd-4803-a568-3bcc85b6a55b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/onboarding-app-review-3hzdaa

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}