Bump vulnerable dependencies flagged by Dependabot

[mrgeoffrich]

Closes #414

Bumps the packages Dependabot flagged across the three manifests in this repo.

Go — go.mod

golang.org/x/net moved from 0.53.0 to 0.55.0, clearing GHSA-5cv4-jp36-h3mw.

Go — desktop/go.mod

github.com/go-git/go-git/v5 moved from 5.19.1 to 5.19.2, clearing
GHSA-hc8v-wwc9-vgxm and GHSA-qgq7-7hm3-q39j.

golang.org/x/crypto was requested at 0.52.0 and golang.org/x/net at
0.55.0, but go-git 5.19.2 itself requires golang.org/x/crypto 0.53.0 and
golang.org/x/net 0.56.0. Go's minimum version selection resolved both to
those higher versions. Both still land above the requested floor and clear
every advisory against them.

npm — desktop/frontend/package-lock.json

react-router and vite are direct dependencies, bumped to 7.18.2 and
8.0.16. Bumping vite also pulled postcss to a clean version and dropped a
vulnerable nanoid transitively — neither needed a manual change.

brace-expansion, js-yaml, linkify-it, markdown-it and undici are
transitive, pulled in by eslint, tiptap-markdown and jsdom. None of their
parents offer a fixed version directly, so they're pinned through
overrides in package.json:

• js-yaml to 4.3.1
• linkify-it to 5.0.2
• markdown-it to 14.2.0
• undici to 7.29.0
• brace-expansion to 5.0.9, not the requested 5.0.7

5.0.7 clears GHSA-3jxr-9vmj-r5cp, the advisory this bump was filed against.
It doesn't clear two further high-severity advisories against
brace-expansion, GHSA-mh99-v99m-4gvg (fixed in 5.0.8) and
GHSA-rgw5-rvv9-x895 (fixed in 5.0.9). npm audit --audit-level=high still
flagged brace-expansion as high at 5.0.7, so it's pinned to 5.0.9 instead.

npm audit --audit-level=high now reports zero vulnerabilities.

Verification

Baseline (before any change), using the commands .github/workflows/ci.yml
runs:

• root go build ./..., go vet ./..., go test ./...: all pass
• desktop/frontend: npm ci, npm run lint, npm run test,
  npm run build, npm run build:web: all pass (56 test files, 442 tests,
  15 smoke suites)

Same commands after the bump: same results, nothing regressed.

desktop/go.mod isn't built in CI (noted in ci.yml as out of scope until
the desktop app is a released artifact). Checked anyway: go vet ./... and
go test ./... pass, matching baseline. go build ./... fails baseline
and after the bump identically, in desktop/build/ios only
(runtime.main_main·f: function main is undeclared in the main package) —
pre-existing, unrelated to this change.

govulncheck ./... against both Go modules shows no remaining module-level
finding for golang.org/x/net, golang.org/x/crypto or
github.com/go-git/go-git/v5. What's left in both modules is entirely Go
standard library findings tied to the go1.26 toolchain itself, out of scope
here.

[mrgeoffrich]

This reconciles the 12 open Dependabot PRs against the versions this PR actually lands. Versions come from desktop/frontend/package-lock.json, desktop/go.mod and go.mod in this PR, not from the Dependabot target ranges.

Dependabot PR	Package	Path	Dependabot target	This PR lands	Verdict
#413	js-yaml	desktop/frontend	4.3.1	4.3.1	SUPERSEDED
#412	github.com/go-git/go-git/v5	desktop	5.19.2	5.19.2	SUPERSEDED
#400	undici	desktop/frontend	7.29.0	7.29.0	SUPERSEDED
#399	postcss	desktop/frontend	8.5.25	8.5.26	SUPERSEDED
#397	react-router	desktop/frontend	8.3.0	7.18.2	SHORTFALL
#396	linkify-it	desktop/frontend	5.0.2	5.0.2	SUPERSEDED
#395	brace-expansion	desktop/frontend	1.1.16	5.0.9	SUPERSEDED
#394	golang.org/x/crypto	desktop	0.52.0	0.53.0	SUPERSEDED
#393	golang.org/x/net	repo root	0.55.0	0.55.0	SUPERSEDED
#392	golang.org/x/net	desktop	0.55.0	0.56.0	SUPERSEDED
#389	markdown-it	desktop/frontend	14.2.0	14.2.0	SUPERSEDED
#388	vite	desktop/frontend	8.0.16	8.0.16	SUPERSEDED

#397 is the one to keep open. This PR moves react-router from 7.15.1 to 7.18.2 in desktop/frontend/package.json and the lockfile. #397 proposes 8.3.0, a major version ahead. Merging this PR does not do that jump.

#395 needs a note. This PR adds an overrides block to desktop/frontend/package.json that pins brace-expansion to 5.0.9 across the whole dependency tree. That is numerically higher than the 1.1.16 Dependabot proposed, so it reads as superseded by version alone. But the override replaces the nested brace-expansion copies that eslint and glob pull in through minimatch@3.1.5, which declares brace-expansion: ^1.1.7. After this PR, no resolved 1.x entry for brace-expansion remains anywhere in package-lock.json. Worth confirming npm run lint still works before treating this as a clean win.

The 11 SUPERSEDED Dependabot PRs get closed with a comment naming this PR and the version it lands. #397 stays open.