Fix vite/esbuild security advisories (REV-37, Dependabot #14–#17)

[revopushbot]

Closes REV-37.

Clears all four Dependabot alerts on the docs site, all transitive through vitepress > vite (and vite > esbuild) in pnpm-lock.yaml.

Change

A single pnpm override in package.json:

"overrides": {
  "vite": "^6.4.3"
}

Resolves vite 5.4.21 → 6.4.3 and, transitively, esbuild 0.21.5 → 0.25.12.

Why

The installed vite@5.4.21 is the final, EOL, unpatched 5.x release. The advisories' <= 6.4.2 ranges (introduced at 0) sweep in the whole 5.x line, so Dependabot / pnpm audit flag it — but the actual fixes only landed in vite 6.4.3+/7.x/8.x. vitepress@1.6.4 (latest stable) pins vite@^5.4.14, so an override is required. Vite 6.4.3 is the closest major to what vitepress expects, minimizing breakage risk, and it depends on esbuild@^0.25.0 — so bumping vite clears the esbuild advisory automatically, no separate esbuild override needed.

#	Advisory	Severity	Patched in
#16	GHSA-fx2h-pf6j-xcff — server.fs.deny bypass on Windows alternate paths	High	vite ≥ 6.4.3
#15	GHSA-4w7w-66w2-5vf9 — path traversal in optimized deps .map handling	Moderate	vite ≥ 6.4.2
#17	GHSA-v6wh-96g9-6wx3 — launch-editor NTLMv2 hash disclosure via UNC paths	Moderate	vite ≥ 6.4.3
#14	GHSA-67mh-4wv8-2f99 — esbuild dev server accepts any request / reads response	Moderate	esbuild ≥ 0.25.0

Verification

• pnpm audit → No known vulnerabilities found
• pnpm build (vitepress) → build complete ✅
• pnpm test (vitest) → 1 passed ✅

VitePress 1.6.4 builds cleanly on vite 6 despite its declared ^5 peer, so no functional regression.

🤖 Generated with Claude Code