chore(deps): security fixes for dev/build tooling (Storybook, Vitest, Vite, transitive)

The npm advisory database flagged 19 packages in pnpm-lock.yaml. None of them
ship in the embedded call bundle (checked against the built dist); they run
on developer machines and in CI:
- storybook / @storybook/* 10.6.0 -> 10.6.3: critical, dev server code
  injection from the local network.
- vitest 4.1.12 (+ @vitest/ui unpinned to ^4.1.12), tinypool ^2.1.2:
  mock registration code injection, prototype-pollution RCE.
- vite ^8.3.5: dev-server file exposure, launch-editor issues.
- Overrides for transitive tooling: brace-expansion, browserslist,
  smol-toml, source-map-js, postcss-selector-parser, baseline-browser-
  mapping, fflate, pbkdf2, zod 4; existing qs/js-yaml/undici/dompurify
  overrides raised to the fixed versions.

Left: elliptic (no fixed release, low), zod 3 (no 3.x fix; a dependency
pins it). Lotus unit tests 144/144, build:embedded OK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

package.json

@@ -64,9 +64,9 @@
     "@rolldown/plugin-babel": "^0.2.3",
     "@sentry/react": "^8.0.0",
     "@sentry/vite-plugin": "^3.0.0",
-    "@storybook/addon-docs": "^10.3.6",
+    "@storybook/addon-docs": "^10.6.3",
-    "@storybook/addon-vitest": "^10.3.6",
+    "@storybook/addon-vitest": "^10.6.3",
-    "@storybook/react-vite": "^10.3.6",
+    "@storybook/react-vite": "^10.6.3",
     "@testing-library/dom": "^10.1.0",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.0.0",
@@ -86,9 +86,9 @@
     "@vector-im/compound-design-tokens": "^11.0.0",
     "@vector-im/compound-web": "^10.0.0",
     "@vitejs/plugin-react": "^6.0.2",
-    "@vitest/browser-playwright": "^4.1.5",
+    "@vitest/browser-playwright": "^4.1.12",
     "@vitest/coverage-v8": "^4.0.18",
-    "@vitest/ui": "4.1.11",
+    "@vitest/ui": "^4.1.12",
     "babel-plugin-react-compiler": "^1.0.0",
     "classnames": "^2.3.1",
     "copy-to-clipboard": "^3.3.3",
@@ -123,18 +123,18 @@
     "react-use-measure": "^2.1.1",
     "rxjs": "^7.8.1",
     "sass": "^1.42.1",
-    "storybook": "^10.3.6",
+    "storybook": "^10.6.3",
     "typescript": "^5.8.3",
     "unique-names-generator": "^4.6.0",
     "uuid": "^14.0.0",
     "vaul": "^1.0.0",
-    "vite": "^8.0.0",
+    "vite": "^8.3.5",
     "vite-plugin-html": "^3.2.2",
     "vite-plugin-node-polyfills": "^0.28.0",
     "vite-plugin-node-stdlib-browser": "^0.2.1",
     "vite-plugin-svgr": "^4.0.0",
     "vite-plugin-wasm": "^3.6.0",
-    "vitest": "^4.1.5",
+    "vitest": "^4.1.12",
     "vitest-axe": "^1.0.0-pre.3"
   },
   "packageManager": "pnpm@11.21.0+sha512.521705bce689924eac72f5a3587122f362689ef6571e55ba80076fd637c11132ecffada26fad4ea79c485bfddbfd3d5a2a5b05805a77e893de71ec8a6cca3bb1"

pnpm-workspace.yaml

@@ -28,24 +28,38 @@ overrides:
   # - https://github.com/advisories/GHSA-7r86-cg39-jmmj
   # - https://github.com/advisories/GHSA-23c5-xmqv-rm74
   "minimatch": "^10.2.3"
+  # Security fixes for transitive build/test tooling (none of these ship in the
+  # embedded call bundle; checked against the npm advisory database 2026-10-25).
+  "tinypool": "^2.1.2"
+  "@vitest/mocker": "^4.1.12"
+  "brace-expansion@>=4": "^5.0.12"
+  "browserslist": "^4.28.7"
+  "smol-toml": "^1.8.1"
+  "source-map-js": "^1.2.2"
+  "postcss-selector-parser@>=7": "^7.1.6"
+  "baseline-browser-mapping": "^2.11.0"
+  "fflate@<0.5": "^0.4.9"
+  "fflate@>=0.8": "^0.8.3"
+  "pbkdf2": "^3.1.7"
+  "zod@>=4": "^4.6.6"
   # Security fix: https://github.com/element-hq/element-call/security/dependabot/109
   "glob": "^10.5.0"
   # Security fixes:
   # - https://github.com/element-hq/element-call/security/dependabot/110
   # - https://github.com/element-hq/element-call/security/dependabot/122
   # - https://github.com/element-hq/element-call/security/dependabot/179
-  "qs": "^6.15.2"
+  "qs": "^6.16.0"
   # Security fixes:
   # - https://github.com/element-hq/element-call/security/dependabot/106
   # - https://github.com/element-hq/element-call/security/dependabot/203
-  "js-yaml": "^4.2.0"
+  "js-yaml": "^4.3.2"
   # Storybook declares support for 0.27.0 only but empirically works fine with 0.28.0.
   "esbuild": "^0.28.0"
   # Security fixes:
   # - https://github.com/nodejs/undici/releases/tag/v6.24.0
   # - https://github.com/element-hq/element-call/security/dependabot/201
   # - https://github.com/element-hq/element-call/security/dependabot/199
-  "undici": "^6.27.0"
+  "undici": "^6.29.1"
   # Security fix: https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
   "flatted": "^3.4.2"
   # Security fix: https://github.com/element-hq/element-call/security/dependabot/184
@@ -59,4 +73,4 @@ overrides:
   # - https://github.com/element-hq/element-call/security/dependabot/196
   # - https://github.com/element-hq/element-call/security/dependabot/195
   # - https://github.com/element-hq/element-call/security/dependabot/193
-  "dompurify": "^3.4.11"
+  "dompurify": "^3.4.17"