v322: Fix security package versions

[nicu-chiciuc]

Why

Scout has patched supply-chain findings in both its production and development dependencies. TanStack Start also falls within the affected range of GHSA-qx66-fv34-fjm8, which the package audit does not yet report. The shared Start package and SSR example need the same fix as the main app.

Summary

• Update Start to 1.168.60 and Router to 1.170.41 across the app, SSR example, and shared package dependencies and peers. The lockfile resolves patched server core 1.169.39.
• Resolve patched proxy-addr, source-map-js, Tinypool, qs, sharp, browserslist, baseline-browser-mapping, smol-toml, ip-address, fast-uri, and postcss-selector-parser versions. Align Vitest and its browser-preview and mocker packages at 4.1.11.
• Add a narrow audit exception for GHSA-hp3w-g68c-fv3c. No patched sprintf-js release is published. Its only caller is just-bash, whose printf handler catches the precision RangeError and returns a command error. Add three tests at the workspace shell boundary to verify f, e, and g errors return exit code 1 and leave the shell usable. The exception comment requires a recheck after 2026-10-17.
• Keep the unpatched development-only braces finding visible.

Validation

• Frozen installation, peer checks, formatting, lint, and all seven TypeScript checks pass. All 1,028 registry signatures verify.
• pnpm run check passes 1,691 tests, with 11 existing skips. The focused workspace shell file passes all 24 tests.
• The production audit passes with the one documented sprintf-js exception. The development audit at critical severity passes; the full audit retains the unpatched braces finding.
• The Scout app and SSR example build with the localhost Convex URL used by CI. No production deployment was run locally.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	scout	e2dbb71	Commit Preview URL Branch Preview URL	Oct 06 2026, 09:39 AM