fix(deps): use mature vite 6/vitest 3 and move overrides to workspace

The 3.0.4 bump tripped web CI two ways:
- pnpm 11 ignores the package.json "pnpm" field, so the transitive
  overrides silently didn't apply. Moved them to pnpm-workspace.yaml.
- Vite 8 / rolldown were published within the runner's minimumReleaseAge
  supply-chain cutoff. The advisories only require vite >=6.4.3 and
  vitest >=3.2.6, both mature; pin those instead of the latest majors.

Audit still clean, frozen-lockfile passes, typecheck/lint/200 tests/build
all green. No new packages fall within the release-age cutoff.

Author: Mnikley

CHANGELOG.md

@@ -3,5 +3,5 @@
 ## 3.0.4 — 2026-07-09
 
 * Removed the unused `xlsx` (SheetJS) web dependency, eliminating its prototype-pollution and ReDoS advisories. `.xlsx`/`.tsv` uploads are parsed by the existing TSV reader and were never routed through this package.
-* Upgraded the web build toolchain — Vite 5 → 8, Vitest 2 → 4, `@vitejs/plugin-react` 4 → 6 — clearing the Vite path-traversal / `server.fs.deny` bypass advisories, the critical Vitest UI-server RCE, and the transitive esbuild dev-server advisory.
-* Pinned patched transitive dev dependencies via pnpm `overrides`: `form-data` ≥4.0.6 (CRLF injection), `ws` ≥8.21.0, and `js-yaml` ≥4.2.0 (quadratic-complexity DoS).
+* Upgraded the web build toolchain — Vite 5 → 6.4.3, Vitest 2 → 3.2 — clearing the Vite path-traversal / `server.fs.deny` bypass advisories, the critical Vitest UI-server RCE, and the transitive esbuild dev-server advisory.
+* Pinned patched transitive dev dependencies via pnpm `overrides` (in `pnpm-workspace.yaml`): `form-data` ≥4.0.6 (CRLF injection), `ws` ≥8.21.0, and `js-yaml` ≥4.2.0 (quadratic-complexity DoS).

web/package.json

@@ -33,7 +33,7 @@
     "@types/react-dom": "^18.3.1",
     "@typescript-eslint/eslint-plugin": "^8.15.0",
     "@typescript-eslint/parser": "^8.15.0",
-    "@vitejs/plugin-react": "^6.0.3",
+    "@vitejs/plugin-react": "^4.7.0",
     "autoprefixer": "^10.4.20",
     "eslint": "^9.15.0",
     "eslint-config-prettier": "^9.1.0",
@@ -45,15 +45,7 @@
     "prettier": "^3.3.3",
     "tailwindcss": "^3.4.14",
     "typescript": "^5.6.3",
-    "vite": "^8.1.4",
-    "vitest": "^4.1.10"
-  },
-  "pnpm": {
-    "comment": "Pin patched versions of transitive dev-only deps flagged by Dependabot; all are minor/patch bumps within the dependents' accepted major range.",
-    "overrides": {
-      "form-data": ">=4.0.6",
-      "ws": ">=8.21.0",
-      "js-yaml": ">=4.2.0"
-    }
+    "vite": "^6.4.3",
+    "vitest": "^3.2.6"
   }
 }