chore(deps): clear the six open Dependabot alerts (react-router, undici)

[elluff]

Closes the six open Dependabot alerts. All six are npm, transitive, and confined to frontend/pnpm-lock.yaml; none is exploitable in this deployment, but each fix lands inside the ranges already declared, so fixing costs less than arguing.

react-router 7.18.1 → 7.18.2

Closes #26 (GHSA-qwww-vcr4-c8h2, HIGH: RSC-mode CSRF bypass, a follow-up to CVE-2026-22030).

• Reachability: the vulnerable path is RSC mode and server actions. This frontend is a client-only Vite SPA with no @react-router/dev, no server entry, and no react-router/rsc imports, so it never enters that path.
• Why the parent moves: react-router-dom@7.18.1 pins react-router to an exact version, so bumping react-router alone is a no-op.
• No v8 migration: the advisory now reports 7.18.2 as the first patched version, i.e. the fix was backported into the 7.x line. The v8 jump this used to require (v8 deletes react-router-dom and moves 16 import sites) is out of the picture.

undici 7.28.0 → 7.29.0

Closes #20, #22, #23, #24 (MEDIUM) and #21 (HIGH): degenerate private cache directives, CRLF injection via a blob-like body type, cookie attribute injection, cross-user disclosure via whitespace in Cache-Control, and response desynchronization in the retry interceptor.

• Reachability: undici is pulled only by jsdom, a devDependency serving as the Vitest DOM environment. It never enters the shipped bundle, and every one of these advisories needs the test process to make real HTTP requests to a hostile server.
• No jsdom upgrade needed: jsdom@29.1.1 declares undici: ^7.25.0, which accepts 7.29.0.

Two things worth knowing about the diff

package.json moves with the lock (^7.18.1 → ^7.18.2) rather than being held back. Leaving the declared floor at the vulnerable version means a lockfile regeneration can legitimately resolve back to 7.18.1 and reopen the alert; the security floor belongs where the constraint lives.

Five unrelated transitive patches ride along, because pnpm re-resolves on update: color-name 2.1.0 → 2.1.1, color-parse 2.0.2 → 2.1.2, earcut 3.2.0 → 3.2.3, probe-image-size 7.3.0 → 7.4.0, sax 1.6.0 → 1.6.1. Hand-editing the lockfile to suppress them would be a larger risk than the bumps themselves.

Verification

• pnpm install --frozen-lockfile accepts the pair, so the lock and the manifest agree the way CI installs them.
• 148 frontend tests pass, including the 42 router-aware page tests; eslint, tsc -b and vite build clean.
• The installed tree holds exactly one copy of each package, at the patched version, so no vulnerable duplicate survives to keep an alert open.
• No source file changes, so nothing here can touch detection behaviour.

🤖 Generated with Claude Code