fix(security): resolve open code-scanning & Dependabot alerts

docs/scripts/scaffold.mjs

@@ -841,7 +841,9 @@ for (const [relPath, title, description] of PAGES) {
   // etc.) it gets renamed `.md` -> `.mdx`.  We shouldn't recreate
   // a plain-Markdown stub alongside it on the next scaffold run.
   const mdxVariant = full.replace(/\.md$/, '.mdx');
-  if (fs.existsSync(full) || fs.existsSync(mdxVariant)) {
+  // Skip when a hand-authored .mdx variant exists.  This is a different path
+  // than the write target, so it is a plain logic skip, not a race.
+  if (fs.existsSync(mdxVariant)) {
     skipped++;
     continue;
   }
@@ -853,8 +855,18 @@ description: ${JSON.stringify(description)}
 ---
 
 ${stubBody(title, description)}`;
-  fs.writeFileSync(full, content, 'utf-8');
-  created++;
+  // 'wx' fails atomically with EEXIST if `full` already exists, so there is no
+  // check-then-write TOCTOU window (CodeQL js/file-system-race).
+  try {
+    fs.writeFileSync(full, content, { encoding: 'utf-8', flag: 'wx' });
+    created++;
+  } catch (err) {
+    if (err.code === 'EEXIST') {
+      skipped++;
+      continue;
+    }
+    throw err;
+  }
 }
 
 console.log(`scaffold: ${created} stubs created, ${skipped} existing pages skipped (${PAGES.length} total in IA)`);

examples/chat/frontend-svelte/package.json

@@ -11,7 +11,7 @@
   },
   "devDependencies": {
     "@sveltejs/adapter-static": "^3.0.10",
-    "@sveltejs/kit": "^2.69.3",
+    "@sveltejs/kit": "^2.70.3",
     "@sveltejs/vite-plugin-svelte": "^7.2.0",
     "svelte": "^5.56.5",
     "svelte-check": "^4.7.3",
@@ -20,5 +20,8 @@
   },
   "dependencies": {
     "ts-pattern": "^5.9.0"
+  },
+  "overrides": {
+    "cookie": "^0.7.0"
   }
 }