fix(security): bump vite to 7.3.6 + minimatch to 9.0.9 (clears 8 Dependabot alerts)

5 vite alerts (vercel-labs#44/vercel-labs#45/vercel-labs#46/vercel-labs#94/vercel-labs#95, <=7.3.4) + 3 minimatch alerts (vercel-labs#23/vercel-labs#26/vercel-labs#28, <9.0.7) were all in pnpm-lock.yaml. The existing pnpm.overrides were recorded but never applied to the lockfile: vite enters only as vitest's peer (auto-installed peers bypass overrides under the repo's lowest-direct resolution), and the minimatch range-selector override missed the eslint-plugin-react>minimatch edge. Fix: add vite as a direct devDependency (^7.3.5 -> resolves 7.3.6) and add a deterministic nested override eslint-plugin-react>minimatch ^9.0.7 (-> 9.0.9); consolidated the redundant/overlapping vite+minimatch selectors. Targeted lockfile update (33/48 lines), vitest and all other deps unchanged. Verified: pnpm audit clean, type-check 5/5, turbo build 5/5, 166 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HWrTgpQ6CZV7tbVCNib9Pi

Author: danielsimonjr

package.json

@@ -31,6 +31,7 @@
     "prettier": "^3.7.4",
     "turbo": "^2.9.14",
     "typescript": "5.9.2",
+    "vite": "^7.3.5",
     "vitest": "^4.1.0"
   },
   "packageManager": "pnpm@9.0.0",
@@ -44,9 +45,9 @@
     "overrides": {
       "postcss": "^8.5.10",
       "minimatch@<3.1.3": ">=3.1.3",
-      "minimatch@>=9.0.0 <9.0.6": ">=9.0.6",
       "rollup@>=4.0.0 <4.59.0": ">=4.59.0",
-      "minimatch@>=9.0.0 <9.0.7": ">=9.0.7",
+      "minimatch@>=9.0.0 <9.0.7": "^9.0.7",
+      "eslint-plugin-react>minimatch": "^9.0.7",
       "minimatch@<3.1.4": ">=3.1.4",
       "ajv@<6.14.0": ">=6.14.0",
       "flatted@<3.4.0": ">=3.4.0",
@@ -55,12 +56,10 @@
       "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3",
       "picomatch@>=4.0.0 <4.0.4": ">=4.0.4",
       "yaml@>=2.0.0 <2.8.3": ">=2.8.3",
-      "vite@>=7.0.0 <=7.3.1": ">=7.3.2",
-      "vite@>=7.1.0 <=7.3.1": ">=7.3.2",
+      "vite": "^7.3.5",
       "ws@>=8.0.0 <8.20.1": ">=8.20.1",
       "esbuild@>=0.27.3 <0.28.1": ">=0.28.1",
       "ws@>=8.0.0 <8.21.0": ">=8.21.0",
-      "vite@>=7.0.0 <=7.3.4": ">=7.3.5",
       "js-yaml@<=4.1.1": ">=4.2.0"
     }
   }