[rjwalters]

The JavaScript toolchain still contained 16 audit findings, including two critical tinypool advisories. This updates Vite to 7.3.7 and Vitest to 4.1.12, refreshes the affected PostCSS/browser/source-map dependencies, and removes tinypool through the supported Vitest 4 dependency graph. No advisory ignores or forced dependency overrides are added.

Vitest 3 has no listed fix for the current mocker advisories, so this includes a tested major-version migration. Existing application and test sources are unchanged. A new Linux workflow runs the same frozen install, TypeScript/Vite build, workspace tests and full audit on pull requests and master pushes, with Node 26.12.1 and pnpm 12.15.0.

Validation on macOS arm64: frozen install, all workspace tests, TypeScript packages and Studio production build, actionlint and whitespace checks pass. Fresh unfiltered pnpm audit changes from 16 findings (2 critical, 5 high, 8 moderate, 1 low) to zero. CI and independent review remain required. This covers source/build tooling; it does not assert desktop deployment coverage.

Closes #2.

[rjwalters]

Judge: APPROVED at exact head 153fcc5d70103f204df6b15a9ee28157272ff35f. This is an independent review, drafted by an agent session.

• Scope: three dependency floors (Studio vite ^7.3.7; @flybrix/core and @flybrix/protocol vitest ^4.1.12), pnpm-lock.yaml, and a new npm-security.yml workflow. The base is unchanged master (fefd23b9). No app or test source changes, no overrides, no audit ignores.
• Major-version compatibility (Vitest 3 → 4):
  • The repo has no vitest.config or workspace file, so none of v4's removed or renamed config (poolOptions, workspace, deps.inline, …) applies.
  • Studio's vite.config.ts uses only basic options that Vite 7 still supports.
  • The lock delta is the matching v4 package set (@vitest/* 4.1.12, chai 6, tinyrainbow 3; vite-node, tinypool and tinyspy dropped) plus patch-level transitive bumps: postcss 8.5.31, nanoid 3.3.20, browserslist 4.29.4, source-map-js 1.2.2. Every entry is from the registry; there are no tarball, git or file sources.
• CI at this head (run 40041726016):
  • frozen-lockfile install;
  • full build (vite 7.3.7);
  • pnpm test: 95 + 13 = 108 tests passed under Vitest 4;
  • pnpm audit: "No known vulnerabilities found".

I did not reproduce the before-state audit count independently; the after-state is verified by the CI audit step.

Non-blocking: apps/studio has no test suite, so the Vite bump is covered by the production build only.