deps: dashboard dependency sweep — npm audit (vite 8.1.0, js-yaml ≥4.2.0) + @vitejs/plugin-react 6.0.2

[ANcpLua]

Clears the 1 high + 2 moderate npm audit advisories the dashboard surfaced after the recent Renovate lock-file maintenance.

Changes

• vite 8.0.11 → 8.1.0 (high) — GHSA-fx2h-pf6j-xcff (server.fs.deny bypass on Windows alternate paths) + GHSA-v6wh-96g9-6wx3 (launch-editor NTLMv2 hash disclosure via UNC paths). Minor bump within the 8.x major; both CVEs are Windows dev-server only.
• overrides: { "js-yaml": "^4.2.0" } (2× moderate) — GHSA-h67p-54hq-rp68 quadratic-complexity DoS in js-yaml <=4.1.1, pulled in transitively by dev-only tooling: @redocly/openapi-core (via openapi-typescript) and cosmiconfig (via shadcn). npm audit fix couldn't apply it because those parents pin/resolve 4.1.1; 4.2.0 is a backward-compatible minor and staying in 4.x avoids the ESM-only 5.x break for those CJS consumers.

Verification

• npm audit → 0 vulnerabilities (was 1 high + 2 moderate)
• vite build ✓ · vitest 18/18 ✓ · ESLint (src) + tsc -b clean
• npm run generate:ts regenerates an identical src/types/api.ts — dev tooling intact on js-yaml 4.2.0

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• services/qyl.dashboard/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json and included by none
• services/qyl.dashboard/package.json is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: dd68bb39-63aa-4e38-8909-774281ff2b52

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[railway-app]

🚅 Deployed to the qyl-pr-406 environment in qyl

Service	Status	Web	Updated (UTC)
qyl-collector	✅ Success (View Logs)	Web	Jun 26, 2026 at 1:48 am

[ANcpLua]

Folded in @vitejs/plugin-react 6.0.2 (was the separate #401, now superseded). 6.0.2 made npm try to install its optional @rolldown/plugin-babel peer, whose @babel/plugin-transform-runtime@8 → @babel/core@^8 chain conflicts with the project's @babel/core@7 (required by plugin-react's own babel-7 path) → ERESOLVE. The dashboard doesn't use rolldown's babel transform, so the optional tooling is pinned to babel 7 via an overrides entry; npm then skips the babel-8 chain and resolves cleanly. Verified locally: npm ci, npm run build, and 18/18 vitest all pass.