fix(deps): npm audit fix — bump transitive vulns in lockfile

[lsegura-cuenca]

Summary

Aplicación de npm audit fix (sin --force) que solo realiza bumps respetando los rangos semver de package.json. Cero cambios en package.json, solo lockfile. Build verificado verde.

Cierra ~17 alertas Dependabot en transitivas:

Paquete	Versión final	GHSAs
undici	7.24.8	GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8, GHSA-4992-7rv2-5pvq, GHSA-2mjp-6q6p-2qxm, GHSA-g9mf-h72j-4rw9
qs	6.15.1	GHSA-6rw7-vpxm-498p, GHSA-w7fw-mjwx-w883
picomatch	4.0.4	GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p
path-to-regexp	8.4.2	GHSA-j3q9-mxjg-w52f, GHSA-27v5-c462-wpq7
defu	6.1.5	GHSA-737v-mqg7-c878
body-parser	2.2.2	GHSA-wqch-xfxh-vrr4
esbuild	0.25.2 / 0.27.3	GHSA-67mh-4wv8-2f99
rollup	4.60.3	GHSA-mw96-cpmx-2vgc
wrangler	4.90.0	GHSA-36p8-mvp6-cv38
vite	6.4.2	overlap con PR vite (también bumpeado)
postcss	8.5.14	GHSA-qx2v-qp2m-jg93

Test plan

• npm install y npm audit fix sin errores.
• npm run build verde (cliente + SSR build).
• Smoke manual de la app después del merge.

Nota de orden

Este PR puede mergearse antes o después del PR de vite — si se mergea este primero, el PR de vite quedará casi como no-op (solo eleva el floor en package.json).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4c6907ae-9cc4-4c96-9b6f-798d0252c12a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/bump-transitives-lockfile

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}