Dependency security updates

[BYK]

Fix Dependabot Security Vulnerabilities

This PR addresses multiple Dependabot security alerts by updating vulnerable dependencies to their patched versions.

Key Changes:

• Updated various direct and transitive dependencies including cookie, esbuild, brace-expansion, tmp, js-yaml, body-parser, and mdast-util-to-hast.
• Updated @sentry/* packages across the workspace via catalog updates and direct dependency bumps in packages/spotlight/package.json.
• Introduced pnpm.overrides in the root package.json to ensure vite versions 6.0.0-6.3.5 are upgraded to 6.3.6+ to mitigate reported CVEs, specifically targeting transitive vite dependencies brought in by astro.

Verification:

• Build and lint tasks pass successfully.
• Existing test failures in docker-compose.test.ts are noted as pre-existing and unrelated to these dependency updates.

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
spotlightjs	Ready	Preview, Comment	Dec 31, 2025 4:54pm

[sentry]

Bug: The pnpm override for vite uses >=6.3.6, which will pull in vite 7.0.0 (a major version with breaking changes), instead of staying within the 6.x range.
_{Severity: CRITICAL | Confidence: High}

🔍 Detailed Analysis

The pnpm override "vite@>=6.0.0 <6.3.6": ">=6.3.6" in package.json will resolve to the latest available version of vite, which is 7.0.0. This major version introduces breaking changes, such as requiring Node.js 20.19+ and removing the splitVendorChunkPlugin. The packages/website workspace, which depends on astro (which in turn uses vite 6.x), will be forced to use vite 7.0.0. This will likely cause build failures due to the breaking changes. This also creates inconsistent vite versions across the monorepo.

💡 Suggested Fix

Change the override value from >=6.3.6 to ^6.3.6. This will ensure that only versions within the 6.x range are installed, preventing the automatic upgrade to the breaking 7.0.0 major version while still applying the intended security fix.

🤖 Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L44

Potential issue: The `pnpm` override `"vite@>=6.0.0 <6.3.6": ">=6.3.6"` in
`package.json` will resolve to the latest available version of `vite`, which is `7.0.0`.
This major version introduces breaking changes, such as requiring Node.js 20.19+ and
removing the `splitVendorChunkPlugin`. The `packages/website` workspace, which depends
on `astro` (which in turn uses `vite` 6.x), will be forced to use `vite` 7.0.0. This
will likely cause build failures due to the breaking changes. This also creates
inconsistent `vite` versions across the monorepo.

_{Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 8075914}