pnpm-lock: upgrade deps to address vulnerabilities

[xnox]

There are a few vulnerabilities reported with:

npx pnpm audit
...
6 vulnerabilities found
Severity: 2 moderate | 3 high | 1 critical

Fix them by upgrading.

[xnox]

I am not very good with javascript, the lock file updates look less targeted than the resolution updates.

[lunny]

We should submit the PR to the main branch first and then backport it to v1.25. Otherwise, the bug may reappear during future upgrades.

[xnox]

We should submit the PR to the main branch first and then backport it to v1.25. Otherwise, the bug may reappear during future upgrades.

I do not see any vulnerabilities on the main branch.

Unless I am holding pnpm wrong

[techknowlogick]

Thanks!

[techknowlogick]

Cc @silverwind

[xnox]

I have no idea if these upgrades break the gitea UI though :-/

[techknowlogick]

Maintainers note: This targets the 1.25 branch. These are solved in nightly already

[techknowlogick]

Aha, my client hadn't updated yet so I didn't see the above comments already re: main branch

[silverwind]

It is not necessary to edit pnpm.overrides. Upgrade affected direct dependencies via pnpm i dep@version and indirect ones viarm -rf node_modules pnpm-lock.yaml && pnpm i which will regenerate the lockfile and bump all indirect dependencies.

[silverwind]

see above

[silverwind]

Try this:

pnpm i happy-dom@latest vitest@latest markdownlint-cli@latest tailwindcss@latest @vitejs/plugin-vue@latest @playwright/test@latest @vitest/eslint-plugin@latest && rm -rf node_modules pnpm-lock.yaml && pnpm i