chore: resolve Vanta dependency vulnerabilities

[jwfing]

Summary

• Upgrade vulnerable vite and form-data versions flagged for insforge-mcp
• Override transitive hono and esbuild to patched versions
• Refresh package-lock to resolve dependency tree vulnerabilities

Test Plan

• npm audit --omit=optional
• npm run build
• npm test
• npm run lint

Note: Repository default branch is master; no main branch exists on origin, so this PR targets master.

---

Summary by cubic

Resolve Vanta-flagged dependency vulnerabilities by upgrading key build/runtime packages and refreshing the lockfile. No app code changes; ensures patched versions of vite, form-data, hono, and esbuild are used.

• Dependencies
  • Upgrade vite to ^8.1.5.
  • Upgrade form-data to ^4.0.6.
  • Upgrade hono to ^4.12.31 (transitive).
  • Add esbuild at ^0.28.1 to pin a patched version.
  • Refresh package-lock.json (updates toolchain deps like rolldown, @rolldown/*, picomatch, tinyglobby).

^{Written for commit af4fbfd. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Updated several underlying packages to newer versions.
  • Added support for esbuild.
  • Updated the development tooling used to build and run the application.

[coderabbitai]

Walkthrough

package.json updates the form-data, hono, and vite version ranges and adds esbuild as a production dependency.

Changes

Dependency manifest updates

Layer / File(s)	Summary
Dependency version declarations package.json	Production dependency ranges for form-data and hono are upgraded, esbuild is added, and the Vite development dependency is upgraded.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• InsForge/insforge-mcp#62: Also changes package.json dependency management around hono.

Poem

A rabbit hops through packages bright,
hono grows strong and vite takes flight.
esbuild joins the dependency crew,
While form-data gets an update too.
Sniff, commit—fresh versions bloom! 🐇

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title mentions Vanta, but the PR only updates vulnerable npm dependencies like vite, form-data, hono, and esbuild.	Rename the PR to reflect the actual dependency vulnerability fixes, such as updating vite, form-data, hono, and esbuild.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/resolve-vanta-dependency-risks

---

_{Comment @coderabbitai help to get the list of available commands.}

[jwfing]

Code Review — chore: resolve Vanta dependency vulnerabilities

Summary: A clean, correctly-scoped dependency-remediation PR that bumps form-data and vite and forces patched hono/esbuild via overrides, with a fully-regenerated lockfile — no findings.

Requirements context

No matching spec/plan found — the repo has no /docs/superpowers/ (or docs/) directory, and there are no repo-local .claude/skills/. Assessed against the PR description and the CI gate (.github/workflows/ci.yml: npm ci → lint → test → build) alone.

Findings

Critical

(none)

Suggestion

(none)

Information

• Software engineering — package.json:60-73 (overrides use caret ranges). The remediation pins via ^ (e.g. "esbuild": "^0.28.1", "hono": "^4.12.31") rather than exact versions. This is consistent with the block's existing convention (brace-expansion ^5.0.6, glob ^10.5.0, …), so no change is requested; noting only that exact pins give a stricter, more reproducible security floor if that's ever desired. Author's discretion.

Verification performed

Confirmed against the checked-out head (af4fbfd) and compared to base (dad794d):

• Scope — only package.json (+5/-4) and package-lock.json; matches the stated intent exactly. hono/esbuild are applied through the overrides block (correct mechanism for forcing transitive versions), not added to production dependencies.
• Functionality — lockfile is fully regenerated and internally consistent: form-data resolves to a single node at 4.0.6 (no surviving vulnerable transitive copy; the 4.0.5 strings in the lock are picomatch, unrelated), hono → 4.12.31, esbuild → 0.28.1 (override applied, no nested vite-local copy), vite → 8.1.5. No stray 0.27.4 / 1.0.0-rc.15 / 4.12.23 references remain.
• Compatibility — all bumps are patch/minor: vite 8.0.8 → 8.1.5 sits within vitest@4.1.2's peer range (^6 || ^7 || ^8), and esbuild ^0.28.1 satisfies vite's peer requirement (^0.27.0 || ^0.28.0). npm ci consistency holds — base master has the identical lockfile shape (overrides not persisted to the lock root, esbuild still dev:true) and green CI, so this PR introduces no new lock/package.json skew.
• Security — this PR reduces attack surface; no new user input, secrets, logging, or auth changes. Overridden packages are reputable and version-bounded. (Diff contains no library API usage, so no signature checks were needed.)
• Performance — no runtime code changes; no impact.

Verdict

approved (informational — zero Critical findings; the green-checkmark approval remains a separate human action). Recommend confirming the CI run (npm ci/lint/test/build) is green before merge.

[Fermionic-Lyu]

LGTM, Approved. (Relaying John-bot's approved verdict — approved with the maintainer account, since John-bot can't approve its own PR.)

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}