fix(deps): patch 9 vulnerabilities reported by OpenSSF Scorecard (#206)

Addresses all 9 vulnerabilities flagged by the OpenSSF Scorecard
Vulnerabilities check (score 1/10 before, 10/10 after):

- Bumped vite to ^6.4.2 in `src/frontend` and `packages/landing` to pick
up the dev-server path traversal and WebSocket file-read fixes.
- Added `dompurify` (^3.4.1) and `uuid` (^14.0.0) overrides in
`src/frontend` so the transitive mermaid dependencies pull patched
versions without a mermaid major bump.
- Added `brace-expansion` overrides (^1.1.13 for the 1.x chain, ^2.0.3
for the 2.x chain) in `packages/demo-video` to patch the ReDoS in both
eslint dependency trees.
- Bumped Pygments to 2.20.0 (with refreshed hashes) in
`docs/requirements.txt` to pick up the GUID-regex ReDoS fix.

`npm audit` now reports 0 vulnerabilities in all three workspaces, and
all 1137 Node tests, the 44 frontend Vitest tests, and both Vite builds
pass. No runtime code changed.

Closes #205

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dorlugasigal

docs/requirements.txt

@@ -312,9 +312,9 @@ platformdirs==4.9.4 \
     --hash=sha256:1ec356301b7dc906d83f371c8f487070e99d3ccf9e501686456394622a01a934 \
     --hash=sha256:68a9a4619a666ea6439f2ff250c12a853cd1cbd5158d258bd824a7df6be2f868
     # via mkdocs-get-deps
-pygments==2.19.2 \
-    --hash=sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887 \
-    --hash=sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b
+pygments==2.20.0 \
+    --hash=sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f \
+    --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
     # via mkdocs-material
 pymdown-extensions==10.21 \
     --hash=sha256:39f4a020f40773f6b2ff31d2cd2546c2c04d0a6498c31d9c688d2be07e1767d5 \

packages/demo-video/package-lock.json

@@ -20,6 +20,10 @@
     "prettier": "3.6.0",
     "typescript": "5.9.3"
   },
+  "overrides": {
+    "brace-expansion@>=1.0.0 <2.0.0": "^1.1.13",
+    "brace-expansion@>=2.0.0 <3.0.0": "^2.0.3"
+  },
   "scripts": {
     "dev": "remotion studio",
     "build": "remotion bundle",

packages/demo-video/package.json

@@ -9,6 +9,6 @@
     "preview": "vite preview"
   },
   "devDependencies": {
-    "vite": "^6.3.0"
+    "vite": "^6.4.2"
   }
 }

packages/landing/package-lock.json

@@ -38,7 +38,9 @@
   },
   "overrides": {
     "serialize-javascript": "^7.0.3",
-    "lodash-es": ">=4.18.0"
+    "lodash-es": ">=4.18.0",
+    "dompurify": "^3.4.1",
+    "uuid": "^14.0.0"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.6.3",
@@ -49,7 +51,7 @@
     "@vitejs/plugin-react": "^4.4.1",
     "jsdom": "^26.0.0",
     "typescript": "~5.7.2",
-    "vite": "^6.3.0",
+    "vite": "^6.4.2",
     "vite-plugin-pwa": "^0.21.1",
     "vitest": "^3.1.1",
     "workbox-expiration": "^7.3.0",