chore(deps): clear ws DoS advisory and roll up pending dependabot bumps

[kellenmurphy]

Why

The six open Dependabot PRs (#124–#129) all failed CI on the same step — not their bumps, but the npm audit / OSV scanner gates tripping on a newly-published ws advisory (high severity):

• GHSA-96hv-2xvq-fx4p — memory exhaustion DoS from tiny fragments and data chunks

Vulnerable ws@8.20.1 arrives transitively via wrangler → miniflare → ws, so it failed every CI run, including main. npm audit fix --force wanted to downgrade wrangler to 3.x (breaking, wrong direction). Same pattern as the earlier esbuild fix.

What

• security(deps): pin ws to ^8.21.0 (the patched release) via overrides, forcing it across the transitive path. happy-dom already resolves to 8.21.0, so this only moves the wrangler/miniflare copy. Build-time/dev tooling, not shipped — display-only, no release bump.
• Rolls up the six pending Dependabot bumps as individual commits so they land together and pass CI:
  • @sveltejs/kit 2.65.0 → 2.65.1, svelte group (supersedes chore(deps-dev): bump @sveltejs/kit from 2.65.0 to 2.65.1 in the svelte group #124)
  • @vitest/coverage-v8 4.1.8 → 4.1.9 (supersedes chore(deps-dev): bump @vitest/coverage-v8 from 4.1.8 to 4.1.9 #125)
  • typescript-eslint 8.61.0 → 8.61.1 (supersedes chore(deps-dev): bump typescript-eslint from 8.61.0 to 8.61.1 #126)
  • prettier-plugin-svelte 4.1.0 → 4.1.1 (supersedes chore(deps-dev): bump prettier-plugin-svelte from 4.1.0 to 4.1.1 #127)
  • happy-dom 20.10.3 → 20.10.4 (supersedes chore(deps-dev): bump happy-dom from 20.10.3 to 20.10.4 #128)
  • vitest 4.1.8 → 4.1.9 (supersedes chore(deps-dev): bump vitest from 4.1.8 to 4.1.9 #129)

Verification

tsc --noEmit clean · eslint . --quiet clean · npm audit → 0 vulnerabilities · 100% coverage · production build succeeds.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!