fix(deps): remediate security vulnerabilities

[phillipleblanc]

Security: dependency vulnerability remediation

Automated mechanical dependency remediation for spicehq/spice-cloud-deploy-action, addressing open Dependabot security alerts.
Only same-major bumps are applied; cross-major/breaking upgrades are listed below for a human.
Lockfiles refreshed; CI validates.

(repo root) (npm / npm)

Package	Fixed version	Severity	CVSS	SLA deadline	Advisories	Alerts
@grpc/grpc-js	1.14.4	HIGH	7.5	2026-07-11	CVE-2026-48068, CVE-2026-48069	#2, #3
vite	8.0.16	HIGH	0	2026-07-16	CVE-2026-53571	#6
protobufjs	7.6.4	HIGH	7.5	2026-07-19	CVE-2026-48712	#9

Deps are bundled into dist/index.js via esbuild, so dist/ is rebuilt and committed (CI's "Verify dist/ is in sync" check requires it).

Additional same-major security bumps (to satisfy npm audit --omit=dev)

CI's npm audit gate flags newly-published advisories (it also fails on trunk today). These are clean same-major fixes, included here so the gate passes:

Package	→ version	Advisory
protobufjs	7.6.4 (≥7.6.3)	GHSA-f38q-mgvj-vph7 (schema-name shadowing; supersedes the 7.6.1 bump above)
undici	6.27.0	GHSA-p88m-4jfj-68fv, GHSA-vxpw-j846-p89q, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m
form-data	4.0.6	GHSA-hmw2-7cc7-3qxx (CVE-2026-12143, CRLF injection)

npm audit --omit=dev → 0 vulnerabilities after these.

---

Automated mechanical dependency-security update.

[Copilot]

Pull request overview

This PR performs dependency-security remediation for the action’s Node.js project by pinning vulnerable packages to patched versions and refreshing the npm lockfile to ensure the resolved dependency graph uses those fixed versions.

Changes:

• Add/adjust package.json overrides to force patched versions of protobufjs, @grpc/grpc-js, and vite.
• Refresh package-lock.json to reflect the updated resolved versions (and associated transitive updates).

Reviewed changes

Copilot reviewed 1 out of 4 changed files in this pull request and generated no comments.

File	Description
package.json	Pins patched dependency versions via overrides to remediate Dependabot security alerts.
package-lock.json	Updates resolved package versions to match the remediation pins and refreshes the dependency graph.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.