fix(deps): address 8 client and API dependency vulnerabilities (#342)

* fix(deps): upgrade axios to 1.15.0 to fix SSRF, metadata exfiltration, and DoS vulnerabilities (GHSA-3p68-rc4w-qgx5, GHSA-fvcv-3m26-pcqx, GHSA-4hjh-wcwx-xvwj, GHSA-43fc-jf86-j433)

* fix(deps): pin vite to 6.4.2 via scoped override to fix arbitrary file read via dev server WebSocket (GHSA-p9ff-h696-f583)

* fix(deps): pin picomatch to 2.3.2 and 4.0.4 via scoped overrides to fix ReDoS via extglob quantifiers (GHSA-c2c7-rcm5-vvqj)

* fix(deps): pin lodash to 4.18.1 via scoped override to fix code injection via _.template imports (GHSA-r5fr-rjxr-66jc)

Author: mitoperni

package.json

@@ -13,14 +13,22 @@
     "splitenv": "node scripts/splitenv.mts .env API CLIENT DATABASE LOAD_TESTS WEBSHOT",
     "test:splitenv": "vitest run scripts/splitenv.test.mts"
   },
+  "pnpm": {
+    "overrides": {
+      "vitest>vite": "6.4.2",
+      "micromatch>picomatch": "2.3.2",
+      "vite>picomatch": "4.0.4",
+      "archiver-utils>lodash": "4.18.1"
+    }
+  },
   "devDependencies": {
     "@eslint/eslintrc": "3.3.0",
     "@eslint/js": "9.22.0",
     "@types/config": "3.3.5",
     "@types/node": "22.13.10",
     "@types/supertest": "6.0.2",
     "@vitest/coverage-v8": "3.1.1",
-    "axios": "1.8.4",
+    "axios": "1.15.0",
     "config": "3.3.12",
     "cross-env": "7.0.3",
     "env-cmd": "10.1.0",