Fix security vulnerabilities with targeted solutions

[wycats]

Summary

This PR fixes all reported security vulnerabilities using targeted solutions rather than blanket overrides.

Approach

1. Fixed directly where possible:

   • Updated vite from 6.1.1 to 7.0.2 (fixes esbuild vulnerability)
   • Updated mocha from 10.2.0 to 11.7.1 in @glimmer/vm-babel-plugins (fixes nanoid and serialize-javascript vulnerabilities)

2. Added minimal overrides for third-party issues:

   • @oclif/plugin-warn-if-update-available: Fix lodash.template vulnerability (from tracerbench)
   • d3-color: Fix ReDoS vulnerability (from tracerbench)
   • got: Fix UNIX socket redirect vulnerability (from auto-dist-tag)
   • esbuild: Ensure all transitive dependencies use secure version

Vulnerabilities Fixed

All 7 vulnerabilities resolved:

• 2 HIGH: d3-color ReDoS, lodash.template command injection
• 5 MODERATE: got redirect, nanoid predictability, esbuild dev server, serialize-javascript XSS, additional esbuild instances

Follow-up Actions

We should file issues with upstream packages:

• tracerbench: Update @oclif/plugin-warn-if-update-available and d3-color dependencies
• auto-dist-tag: Update package-json dependency to get newer got

Test Plan

• pnpm audit shows no vulnerabilities
• pnpm install completes successfully
• All tests pass
• No functionality regressions

[github-actions]

	This PR	main
Dev	588K └─┬ . 169K ├── runtime 160K ├── syntax 100K ├── compiler 58K ├── opcode-compiler 27K ├── manager 24K ├── validator 11K ├── program 8.9K ├── reference 7.2K ├── destroyable 6.3K ├── util 4.3K ├── node 3.4K ├── global-context 2.5K ├── wire-format 1.0K ├── vm 969B ├── encoder 844B ├── vm-babel-plugins 606B └── owner	588K └─┬ . 169K ├── runtime 160K ├── syntax 100K ├── compiler 58K ├── opcode-compiler 27K ├── manager 24K ├── validator 11K ├── program 8.9K ├── reference 7.2K ├── destroyable 6.3K ├── util 4.3K ├── node 3.4K ├── global-context 2.5K ├── wire-format 1.0K ├── vm 969B ├── encoder 844B ├── vm-babel-plugins 606B └── owner
Prod	231K └─┬ . 70K ├── syntax 63K ├── runtime 48K ├── compiler 18K ├── opcode-compiler 7.9K ├── manager 5.1K ├── validator 4.8K ├── program 3.6K ├── reference 2.4K ├── util 2.1K ├── node 1.6K ├── wire-format 1.5K ├── destroyable 737B ├── vm 594B ├── global-context 516B ├── encoder 469B ├── vm-babel-plugins 155B └── owner	231K └─┬ . 70K ├── syntax 63K ├── runtime 48K ├── compiler 18K ├── opcode-compiler 7.9K ├── manager 5.1K ├── validator 4.8K ├── program 3.6K ├── reference 2.4K ├── util 2.1K ├── node 1.6K ├── wire-format 1.5K ├── destroyable 737B ├── vm 594B ├── global-context 516B ├── encoder 469B ├── vm-babel-plugins 155B └── owner

[NullVoxPopuli]

seems good