[pacphi]

Summary

This PR folds the in-major Dependabot PRs into one branch and makes the pnpm audit step of Typecheck · Lint · Format · Test · Build pass.

On main, pnpm audit reports 21 findings: 1 low, 9 moderate and 11 high. CI runs pnpm audit with no --audit-level, so every finding fails the job. On this branch, the result is No known vulnerabilities found. All 11 open Dependabot alerts are cleared.

The PR changes package.json, pnpm-lock.yaml and one e2e assertion timeout. It does not change packageManager, which is #12's change, and it does not change ci.yml, because both action bumps are majors.

Superseded PRs

PR	Package(s)	Dependabot bump	Taken here	Area
#3	vite	8.0.14 → 8.0.16	^8.3.4	dev tooling (npm)
#9	@playwright/test, eslint, globals, prettier, vite, vitest	1.60.0 → 1.62.0, 10.4.1 → 10.8.0, 17.6.0 → 17.8.0, 3.8.3 → 3.9.6, 8.0.14 → 8.1.5, 4.1.7 → 4.1.10	^1.64.1, ^10.13.0, ^17.13.0, ^3.9.10, ^8.3.4, ^4.1.12	dev tooling (npm)
#10	three, @types/three	0.184.0 → 0.185.1, 0.184.1 → 0.185.1	^0.185.1, ^0.185.4	runtime (npm)

Each version taken is the newest in its current major that was published at least 3 days ago. vite 8.3.5 was published on 2026-10-21, so this PR stops at 8.3.4.

three r185: Under caret rules, ^0.184 does not include 0.185, so I checked the r184 → r185 entries in the migration guide. Every entry covers WebGPU/TSL nodes, loaders and exporters, Matrix3 helpers, or matrixAutoUpdate. src/ uses none of them: it uses the core WebGL classes and three/addons/postprocessing (EffectComposer, RenderPass, UnrealBloomPass, ShaderPass). Build, unit tests and e2e all pass. I stayed on the r185 line that Dependabot proposed and did not move to 0.186.

Deferred (major)

PR	Bump	Why deferred
#11	typescript 6.0.3 → 7.0.2	Major (the native port). It fixes no advisory. TS 7 applies the 6.0 defaults, turns 6.0 deprecations into hard errors, and reworks JSDoc/JS checking (announcement). In this repo it raises 2 × TS2810 in src/ui/menus.js (lines 22 and 65): new Promise((res) => …) in checkJs mode needs a Promise<void> JSDoc hint before res() can be called with no arguments.
#4	actions/checkout v6 → v7	Major. It fixes no advisory. v7.0.0 moves the action to ESM and blocks checking out fork PR code under pull_request_target/workflow_run (release notes). This repo triggers only on push and pull_request, so no impact is expected.
#8	actions/setup-node v6 → v7	Major. It fixes no advisory. v7.0.0 moves the action to ESM and removes the dummy NODE_AUTH_TOKEN export (release notes). Both jobs use only node-version and cache: pnpm, and nothing publishes to npm, so no impact is expected.

Not touched: #12 (Node/pnpm migration) and #13 (Renovate onboarding).

Fixes (pre-existing and upgrade-caused)

• The pnpm audit step was failing on main (21 findings), and the test and build steps after it never ran in CI. This PR fixes the audit. Locally, both test and build pass.

• The e2e smoke test fails with Playwright ≥ 1.62. This is upgrade-caused and is the same failure build(deps-dev): bump the dev-dependencies group with 6 updates #9 hit: #lap is still empty after the fixed 1.5 s wait plus the default 5 s timeout. I reproduced it in the mcr.microsoft.com/playwright Docker image with 2 CPUs and bisected it:

  Variant	Time until the HUD shows LAP
  main (Playwright 1.60 / Chromium 148)	~4.0 s
  main + Playwright 1.64.1 (Chromium 156)	~7.5 s
  this branch + Playwright 1.60.0	~4.4 s
  this branch (Playwright 1.64.1)	~8.2 s

  The newer headless Chromium renders this scene more slowly under SwiftShader. The vite and three versions make no difference, and there was no dev-server reload or console error. The fix is test-only: that one assertion's timeout goes to 20 s (tests/e2e/smoke.spec.js), and the game code is unchanged. With the fix, three runs in Docker passed.

Security audit

Every finding comes in through a devDependency (vite, vitest, eslint) and none reaches the shipped bundle. All of them are fixed by updates within the current major. No overrides and no audit ignores were added.

Package	Advisories	Before → after	How
vite	GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22, GHSA-9jrq-w75r-8gcw	8.0.14 → 8.3.4	Direct bump (fixed in ≥ 8.1.6)
vitest, @vitest/mocker	GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8	4.1.7 → 4.1.12	Direct bump
postcss	GHSA-r28c-9q8g-f849, GHSA-fxqj-rqcc-2cmp	8.5.15 → 8.5.31	Refreshed with vite
nanoid	GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8	3.3.12 → 3.3.20	Refreshed with vite → postcss
source-map-js	GHSA-68fv-2mgg-jv7q	1.2.1 → 1.2.2	Refreshed with vite → postcss
brace-expansion	GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895, GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr	5.0.6 → 5.0.12	pnpm update brace-expansion --depth Infinity. This is a lockfile refresh within minimatch 10.2.5's range.

3-day release age

I resolved with --config.minimum-release-age=4320. I then checked every new name@version in the lockfile diff (67 entries) against the npm registry time field. The newest is postcss 8.5.31, published 2026-10-18 19:39 UTC. There are no exceptions.

Verification

Run locally with Node 26.12.1 and pnpm 11.2.2 (packageManager), starting from a clean node_modules:

pnpm install --frozen-lockfile   -> exit 0
pnpm run typecheck               -> exit 0
pnpm run lint                    -> exit 0
pnpm run format:check            -> exit 0  (All matched files use Prettier code style!)
pnpm audit                       -> exit 0  (No known vulnerabilities found)
pnpm run test                    -> exit 0  (4 files, 23 tests passed)
pnpm run build                   -> exit 0
CI=1 pnpm run e2e  (macOS, x3)   -> exit 0  (1 passed, each run)
playwright test in mcr.microsoft.com/playwright:v1.64.1-noble, --cpus=2 (x3) -> 1 passed, each run

🤖 Generated with Claude Code