chore: upgrade deps to resolve high/moderate security CVEs

[collinsezedike]

Summary

• Fixes 9 vulnerabilities (5 high, 3 moderate, 1 low) found by pnpm audit
• Zero regressions: all 6 TypeScript packages pass typecheck after upgrade
• Closes [Security] Upgrade dependencies to resolve high/moderate security CVEs #43

Changes

Package	Before	After
fastify	4.29.1	5.8.5 — fixes content-type bypass (high), header spoofing (moderate), DoS (low)
@fastify/cors + @fastify/rate-limit	9.x	11.x / 10.x — Fastify v5 compat
vite	5.4.21	6.4.2 — fixes path traversal in optimised deps (moderate)
@vitejs/plugin-react	4.7.0	5.2.0 — Vite 6 compat (peer dep range covers 4–7)
vitest	1.6.1	3.2.4 — pulls esbuild ≥0.25, fixing shell injection CVE (moderate)
fast-uri (pnpm override)	3.1.0	3.1.2 — resolves 2 high path-traversal/host-confusion CVEs
turbo / tsx / react-query	various	patch/minor bumps

Major version upgrades (React 19, TS 6, Zod 4, Tailwind 4, redis 5, stellar-sdk 15) deferred to dedicated PRs.

Test plan

• pnpm audit → No known vulnerabilities found
• pnpm typecheck → 6/6 packages pass

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
meridian	Ready	Preview, Comment	May 24, 2026 5:27pm