[luv-legion-650] Clear the undici advisories and land Dependabot #641-#649

[NiveditJain]

Every open PR in the repo was red on the Supply Chain (OSV-Scanner) gate —
including all nine open Dependabot bumps, none of which touch the package that
was failing. This clears the shared blocker and folds those nine bumps in.

Based on failproofaid and targeted at it, since #632 is the branch currently
carrying release work and needs the gate green.

The blocker: five undici advisories

undici@7.28.0 picked up five advisories that published after main's last
green scan, so every branch went red at once with no dependency change of its
own:

Advisory	CVSS	Summary
GHSA-4cwx-7wf7-3272	7.4 high	Cross-user information disclosure + parse-time crash via degenerate private cache directives
GHSA-jr45-8vmc-qm54	5.9	Same disclosure via whitespace around = in Cache-Control
GHSA-8xcm-r25x-g524	4.8	Downstream response desynchronization via the retry interceptor
GHSA-v3r7-h72x-cjcm	4.8	Cookie attribute injection via unsanitized domain / unparsed setCookie
GHSA-m8rv-5g2x-5cg5	4.2	CRLF injection via a blob-like body type

All five are fixed in 7.29.0. undici is not a direct dependency — it
arrives transitively under the jsdom test environment — and the 7.28.0 pin was
itself the previous round of this same fix (#446), so the repair is a one-line
bump of that existing overrides entry rather than a lockfile update. Fixing
rather than allow-listing, per osv-scanner.toml's stated preference.

Same shape as the brace-expansion fix on #632 and the next/sharp incident
before it (#591).

Folding in Dependabot #641–#649

With the shared blocker gone, each of these was red on that finding and nothing
of its own, so they land here rather than as nine separate merges:

PR	Bump
#641	actions/download-artifact 4 → 8
#642	docker/login-action 4.5.1 → 4.6.0
#643	actions/upload-artifact 4 → 7
#644	posthog-node 5.46.1 → 5.47.7
#645	jsdom 30.0.0 → 30.0.1
#646	@tanstack/react-virtual 3.14.8 → 3.14.9
#647	lucide-react 1.27.0 → 1.28.0
#648	@types/node 26.1.1 → 26.1.2
#649	@vitejs/plugin-react 6.0.3 → 6.0.5

The npm bumps move their declared floors too, so the tree cannot resolve back.
Those six packages plus their transitive companions (@posthog/core,
@posthog/types, @tanstack/virtual-core) are the only entries the
lockfile moves — verified against the diff, no incidental drift.

The two artifact actions have to land together

build-daemon.yml uploads the failproofaid-* binaries that publish.yml
downloads, so bumping one major without the other would split the release path
across two versions. Rather than assume the majors are drop-in, every input in
use was checked against each target's action.yml:

• upload v7 — name, path, if-no-files-found all survive; the new
  archive input defaults to true, so the artifact is still zipped.
• download v8 — pattern, path, merge-multiple all survive; skip-decompress
  defaults to false, so the zip round trip is unchanged.

Both carry a node24 runtime. translate-docs.yml was already on v7/v8, so
this leaves the repo on one major instead of straddling two.
docker/login-action stays SHA-pinned (dbcb8138…, verified against the v4.6.0
tag), as that workflow pins all of its actions.

Verification

• CI's own scanner image (ghcr.io/google/osv-scanner-action:v2.3.8) run
  against the updated lockfile: No issues found, exit 0 — with
  osv-scanner.toml still holding zero ignored vulnerabilities. The same
  image against the pre-fix lockfile reproduces the CI failure exactly
  (2 packages, 6 vulnerabilities).
• All four CI jobs reproduced locally before pushing: bun run lint (0 errors,
  the same 5 pre-existing warnings), tsc --noEmit clean, bun run test:run,
  bun run build, bun run test:e2e — all green.
• This exact commit was also pushed to failproofaid and ran a full green CI
  sweep there (all 17 checks, including OSV-Scanner, all four
  cross-compile legs, and test-e2e) before being moved onto this branch.

#641–#649 are closed in favour of this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_013zdtoUrNwGKm7ZYpQTdBZy

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1510a033-dbc6-47bb-811a-b8dd2ed6109d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​tanstack/​react-virtual@​3.14.8 ⏵ 3.14.9				+1
	npm/​posthog-node@​5.46.1 ⏵ 5.47.7	+1		+1	+1
	npm/​lucide-react@​1.27.0 ⏵ 1.28.0
	npm/​@​types/​node@​26.1.1 ⏵ 26.1.2				+2
	npm/​jsdom@​30.0.0 ⏵ 30.0.1	+5		+1	+7
	npm/​@​vitejs/​plugin-react@​6.0.3 ⏵ 6.0.5	+1		+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm jsdom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/jsdom@30.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@30.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report