[marceloceccon]

Resolves all open Dependabot alerts and CodeQL alert #7.

Resolved (Dependabot)

• sharp 0.35.4 -> 0.35.5 (#87) — override
• source-map-js 1.2.1 -> 1.2.2 (#86) — new override
• zod 3.25.76 -> 4.6.7 (#99) — new override zod@<4.6.6; all dependents (ai, @ai-sdk/*, eslint-plugin-react-hooks, zod-validation-error) declare ^3.25 || ^4 support
• undici 7.29.1 -> 7.30.1 (#102) — override
• vite 8.0.16 -> 8.1.6 (#90, #91, #92, #95, #96) — override
• @vitest/mocker 5.0.0 -> 5.0.5 (#93, #94) — vitest ^5.0.0 -> ^5.0.5
• brace-expansion 1.1.16 -> 1.1.21 (#83), 5.0.7 -> 5.0.12 (#82) — overrides
• postcss-selector-parser 6.1.4 -> 6.1.5 (#103) — new override (stays on 6.x for tailwindcss 3)

CodeQL

• js/bad-code-sanitization (build(deps-dev): bump postcss from 8.5.9 to 8.5.10 in the npm_and_yarn group across 1 directory #7) in components/ui/theme-script.ts: values interpolated into the inline <head> script now go through toInlineScriptLiteral(), which JSON-serializes and then escapes <, >, /, U+2028 and U+2029 so the value can't close the <script> tag or break the JS string. Added a unit test. The generated script is unchanged for the current key.

Unresolved

• None of the Dependabot alerts. Note: pnpm audit still reports GHSA-rj75-hqrm-r3gf (postcss-selector-parser <7.1.6, via tailwindcss 3) — no Dependabot alert, and the fix needs the 7.x major that tailwindcss 3 doesn't use.

Verification

• pnpm lint, pnpm format:check, pnpm test (578 pass), pnpm build all pass locally.