fix(deps): resolve HIGH & CRITICAL Dependabot alerts

[pkaeding]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Resolves the open HIGH and CRITICAL Dependabot alerts for this repo.

Describe the solution you've provided

Dependency-only bumps to the minimum patched versions. Scoped to the two manifests with alerts: go.mod and internal/dev_server/ui/package-lock.json.

Go (go.mod)

Package	Old → New	Severity	Alert
github.com/getkin/kin-openapi	0.135.0 → 0.144.0	CRITICAL	GHSA-r277-6w6q-xmqw (#144)

go get github.com/getkin/kin-openapi@v0.144.0 && go mod tidy (this transitively bumped the go directive to 1.25, required by kin-openapi 0.144.0).

Dev-server UI (internal/dev_server/ui)

Direct deps (package.json):

Package	Old → New	Severity	Alerts
react-router	7.12.0 → 7.18.2	HIGH	#99, #104, #108, #110, #146
lodash	4.17.23 → 4.18.1	HIGH	#85
vite	6.4.1 → 6.4.3	HIGH	#81, #129

Transitive deps (lockfile via npm update):

Package	Old → New	Severity	Alerts
rollup	4.41.1 → 4.62.4	HIGH	#63
ws	8.18.0 → 8.21.3	HIGH	#125
postcss	8.5.3 → 8.5.26	HIGH	#139, #147
js-yaml	4.1.1 → 4.3.1	HIGH	#137
minimatch	3.1.2/9.0.5 → 3.1.5/9.0.9	HIGH	#64, #66
brace-expansion	1.1.11/2.0.1 → 1.1.18/2.1.4	HIGH	#135, #136
flatted	3.3.1 → 3.4.4	HIGH	#71
form-data	4.0.4 → 4.0.6	HIGH	#124

Transitive deps pulled by @launchpad-ui/components / @launchpad-ui/navigation via react-router-dom v6 (bumped with scoped overrides in package.json to keep @launchpad-ui on v6 rather than a breaking major upgrade):

Package	Old → New	Severity	Alert
@remix-run/router	1.9.0 → 1.23.3	HIGH	#42
react-router-dom	6.16.0 → 6.30.1	(paired)	—

dist/index.html was regenerated via npm run build (checked into the repo).

Not fixed

None of the open HIGH/CRITICAL alerts were skipped. All 21 open HIGH/CRITICAL alerts (1 CRITICAL Go + 20 HIGH npm) are addressed. Remaining npm audit findings are MODERATE/LOW only and out of scope. The @launchpad-ui/* v6 react-router/react-router-dom MODERATE alerts were intentionally kept on v6 (the only "fix" npm offers is a breaking @launchpad-ui/components major bump); the HIGH one in that subtree (@remix-run/router #42) is fixed via override.

How verified

• go build ./... — passes
• go test ./... — passes (pre-existing unrelated cmd/whoami failure exists on main too)
• UI: npm test, npm run lint, npm run build — all pass
• npm audit — 0 high, 0 critical remaining

Additional context

Dependency lockfile churn is limited to the vulnerable packages and their required transitives (incl. rollup platform binaries); no unrelated @launchpad-ui/react-aria upgrades.

Link to Devin session: https://app.devin.ai/sessions/6883fd54fb31445bb549a31426ce6893
Requested by: @pkaeding

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 3b728c1. Configure here.}

[cursor]

Release Go toolchain version mismatch

Medium Severity

The go directive is now 1.25, required by kin-openapi v0.144.0, but the publish action still pins goreleaser-cross to a Go 1.24.2 image. Release builds therefore run in an older toolchain than go.mod requires, so publishing can fail or depend on an untested automatic toolchain download during CGO cross-compilation.

 

^{Reviewed by Cursor Bugbot for commit 3b728c1. Configure here.}

[devin-ai-integration]

Valid concern. The go directive moved to 1.25 as a transitive requirement of kin-openapi@v0.144.0, while the release path (.github/actions/publish/action.yml) pins ghcr.io/launchdarkly/goreleaser-cross by digest. I can't verify the Go version baked into that pinned image (ghcr requires auth), so I can't confirm whether it's < 1.25.

If the image ships Go < 1.25, goreleaser release would rely on GOTOOLCHAIN=auto downloading 1.25 inside the CGO cross-compile container at release time — untested here. This is release infrastructure and the right fix (bump the goreleaser-cross image digest to a Go 1.25 build vs. explicitly relying on toolchain download) depends on maintainer preference, so flagging rather than changing it unilaterally — especially since this PR is already merged. A follow-up PR bumping the goreleaser-cross image to a Go ≥ 1.25 tag is the likely fix.