chore(deps): update non-major dependencies

[SameDesu123]

PR Checklist

• Required Checks
  • Have you added type definitions?
  • Have you tested your changes?
  • Have you checked that it won't break any existing features?
• If your PR uses models¹, check the following: N/A.
  • Have you checked if it works normally in all models?
  • Have you checked if it works normally in all web, local, and node-hosted versions? If it doesn't, have you blocked it in those versions?
• If your PR is highly AI generated², check the following:
  • Have you understood what the code does?
  • Have you cleaned up any unnecessary or redundant code?
  • Is it not a huge change?
    • We currently do not accept highly AI generated PRs that are large changes.

Summary

Update seven independently versioned utility libraries to pick up upstream fixes, with one commit per library. Include the plugin safety cache invalidation and source-map initialization adjustments required by the updates.

Related Issues

None.

Changes

Library	Before	After
mnemonist	0.40.3	0.40.5
sortablejs	1.15.6	1.15.7
acorn-walk	8.3.4	8.3.5
lodash	4.17.21	4.18.1
fflate	0.8.2	0.8.3
postcss-selector-parser	7.1.1	7.1.6
source-map	0.7.6	0.8.0

• Update package.json and pnpm-lock.yaml together for each library.
• Increment the plugin safety checker version from 3 to 4 so cached results are reevaluated with acorn-walk's traversal of dynamic import options. Add a regression test that checks restricted cookieStore access in those options after cache invalidation.
• Change the browser mappings.wasm CDN URL from source-map@0.7.4 to source-map@0.8.0 and remove the obsolete TypeScript suppression for SourceMapConsumer.initialize.

Impact

• Existing plugin safety results are invalidated once. Restricted identifiers inside dynamic import options are now visited by the checker.
• postcss-selector-parser rejects excessively nested selectors through its new nesting limits. These failures follow the existing CSS error handling. Representative selectors, nested pseudo-classes, and long flat selector chains passed compatibility checks.
• Cross-version fflate compression, ZIP, and gzip-stream checks passed. Both the old and new compressed data were read successfully in the compatibility fixtures.
• The CDN WASM file changes, but the 0.7.5, 0.7.6, and 0.8.0 package WASM binaries are byte-for-byte identical. Real mapping checks using the old CDN binary and the new binary with the 0.8.0 consumer returned the same results for the tested cases.

Additional Notes

• pnpm check: 0 errors, 0 warnings.
• pnpm test: 28 test files passed; 245 tests passed, 3 skipped.
• pnpm build: passed.
• Reviewed the upstream package diffs and tested the APIs used by Risu. End-to-end testing of every desktop and hosted deployment was not performed.

Footnotes

1. Modifies the behavior of prompting, requesting, or handling responses from AI models. ↩

2. Over 80% of the code is AI generated. ↩