fix(deps): close the seven Dependabot alerts

[iamrraj]

Closes every alert GitHub currently reports on main: 3 high, 4 moderate.

Package	Severity	Change	Why it matters here
js-yaml	high	4.1 → 4.3.1	Merge-key chains force quadratic CPU. Direct dependency, used to parse .github/agent.yml — which arrives from a repository, so it is reachable input.
postcss	high	→ 8.5.25 (both manifests)	Path traversal in source-map auto-loading.
protobufjs	moderate	→ 7.6.5	Infinite loop parsing .proto options.
react-router-dom	moderate ×3	6.30 → 7.18.2	The 6.x line has no patch for the alert, so this is the major bump rather than a version pick.

On the react-router major

API-compatible with everything the site uses: BrowserRouter, Routes, Route, Link, NavLink, Navigate, useSearchParams, useLocation, useNavigate, useParams. Verified by typecheck, production build, and a browser pass over every dashboard page — nav links still carry filters across pages.

Two things deliberately left alone

react-router 7.18.2 carries GHSA-qwww-vcr4-c8h2 (>=7.12.0 <8.3.0), and 8.3.0 is not published yet. npm offers a "fix" of 7.11.0 — which is below 7.18.0 and therefore reintroduces the alert this PR closes. The advisory is an RSC-mode CSRF bypass; this is a client-only SPA with no framework mode, no server actions and no RSC (no react-router.config, nothing imports react-router/rsc). Staying on the latest is the better of the two available positions, and this should be revisited when 8.3.0 ships.

The 21 remaining moderate npm audit findings are all probot's OpenTelemetry and Sentry chain. None are in GitHub's alert list, and the only fix npm offers is probot@14 — a major bump of the webhook framework, which does not belong in a dependency patch.

Verification

• npm test — 546 passing
• npx tsc --noEmit — clean, both packages
• npm run build and vite build — clean
• Browser pass over /dashboard, /runs, /tools, /events, /findings

Raised as a PR rather than a direct push, so the test status check runs before this reaches main.

[github-actions]

👀 ShipIT Forge is running a code + security review on this PR… I'll post my review shortly.

[github-actions]

🔍 ShipIT Forge reviewed this PR — 💬 commented (no blocking issues)

0 finding(s) (0 security). See the review above for inline details and suggested fixes.

[github-actions]

ShipIT Forge review

✅ No blocking issues found. I reviewed the changed files and ran:

• 🛡️ Security checks — SSRF, injection (SQL/command/template), broken auth/authz, hardcoded secrets, unsafe deserialization, path traversal, weak crypto.
• 🔧 Code review — correctness, error handling, missing tests, clarity.

Nothing to flag. This is a comment, not an approval — ShipIT Forge never approves PRs; a human reviewer should approve and merge.