chore(deps): clear vite advisories; refresh transitive resolutions (#178)

deno audit reported 17 advisories. The five vite findings (path
traversal, server.fs.deny bypasses, WebSocket file read — all dev-server
scoped) came from the direct vite@8.0.1 pin; it now pins 8.1.4, the same
instance the Astro toolchain already resolves, so the vulnerable
duplicate disappears. Regenerating both lockfiles also floated the
in-range OpenTelemetry stable packages.

The remaining 12 findings (protobufjs 8.0.1, @opentelemetry/core 2.7.1,
esbuild 0.27.7) are exact- or range-pinned inside jazz-tools
2.0.0-alpha.53 — the newest alpha — and cannot float: esbuild ^0.27.0
and the OTel experimental ^0.216.0 lines were fixed only in later
majors. None of that code reaches the shipped client bundle (no OTLP
exporter or protobufjs is bundled; esbuild is dev-only), and lofi never
enables the OTLP telemetry path that would load them server-side.
Re-audit on the next jazz-tools bump.

commit

ea40241c997fcf0bd99602d43ed46930e59ab4de

parent

8c5b010b25a0c5c7fdaa5f5465f45690b585720d

author

FelineStateMachine <dami.etoile@gmail.com>