chore(deps): fix open Dependabot alerts

[galaxyeye]

Bumps the packages behind all 14 open Dependabot alerts on the default branch:

• quinn-proto 0.11.14 -> 0.11.15 (cli/browser4-cli, runtime)
• body-parser 1.20.5 -> 1.20.6 (coworker/gui, runtime)
• vite 5.4 -> 6.4, vitest 2 -> 3.2, postcss -> 8.5.26, esbuild -> 0.25, nanoid -> 3.3.18, vite-plugin-static-copy 1.x -> 3.4 (chrome-extension dev stack)
• js-yaml 3.14.2 -> 3.15.1, brace-expansion 1.1.15 -> 1.1.18 (browser test JS fixtures)

Verified: cargo test (CLI), vitest run + vite build (chrome-extension), coworker GUI node tests, npm audit 0 vulnerabilities in all three npm manifests.

Summary by CodeRabbit

• Chores
  • Updated development tooling used to build, copy, and test the browser extension.
  • No user-facing functionality changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 937d4aae-4946-421d-98b4-ad9c00230d4b

📥 Commits

Reviewing files that changed from the base of the PR and between 1219dbd and aa9de60.

⛔ Files ignored due to path filters (4)

• browser4-core/browser4-browser/src/test/js/package-lock.json is excluded by !**/package-lock.json
• chrome-extension/package-lock.json is excluded by !**/package-lock.json
• cli/browser4-cli/Cargo.lock is excluded by !**/*.lock
• coworker/gui/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• chrome-extension/package.json

Included review availability: Your plan includes up to 4 reviews per rolling hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The extension updates its Vite, vite-plugin-static-copy, and Vitest development dependencies to newer versions.

Changes

Extension tooling

Layer / File(s)	Summary
Update extension tooling versions chrome-extension/package.json	Vite changes to ^6.4.3, vite-plugin-static-copy changes to ^3.4.0, and Vitest changes to ^3.2.7.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to aa9de

This PR updates vulnerable dependency versions and lockfiles across the affected projects, with the stated tests, builds, and audits passing; no actionable merge-blocking risk remains beyond normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the dependency updates that address open Dependabot alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-alerts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}