fix(deps): resolve all Dependabot security alerts

[cameroncuster]

Summary

• upgrade the direct httplib2 runtime dependency to the first patched release
• refresh transitive npm resolutions to remove vulnerable tar, glob, minimatch, brace-expansion, flatted, and picomatch versions
• pin exact patched cookie and rollup resolutions through pnpm workspace overrides
• preserve all application code, visual design, routes, RPC behavior, and direct JavaScript dependency ranges

This addresses all 16 Dependabot alerts currently open on main (12 high, 3 medium, 1 low).

Security verification

• pnpm audit: 0 vulnerabilities
• pip-audit -r scripts/requirements.txt: 0 vulnerabilities
• clean frozen pnpm install from an empty dependency directory: passed
• isolated Python 3.12 install plus dependency compatibility check: passed
• verified httplib2==0.32.0
• verified no vulnerable runtime package versions remain in pnpm-lock.yaml

Application verification

• pnpm run lint: passed
• pnpm run lint:es: passed
• pnpm run check: passed
• pnpm run test: 271 passed
• pnpm run build: passed
• pnpm run test:e2e: 167 passed, 5 intentional project-specific skips

Risk

Low. No application source or visual files changed. The exact cookie@0.7.2 override is outside SvelteKit 2's declared ^0.6.0 range, but preserves the parse/serialize API SvelteKit uses; the full production build and desktop/mobile browser suites pass. The override can be removed when SvelteKit natively adopts a patched cookie release.

---

Pull Request opened by Augment Code | View session

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gitgud	Ready	Preview, Comment	Jul 24, 2026 4:12pm