bump deps for security advisories

Upgrade vite to ^8.0.9 in all workspace packages and add pnpm overrides
for transitive deps flagged by Dependabot: picomatch ^4.0.4,
brace-expansion ^5.0.5 (for the 4.x–5.0.4 range), and lodash ^4.18.1.

https://claude.ai/code/session_016M1WhU39uEduoEoMUXb5sw

Author: claude

package.json

@@ -17,5 +17,12 @@
     "oxlint": "^1.56.0",
     "typescript": "^5.9.3"
   },
+  "pnpm": {
+    "overrides": {
+      "picomatch": "^4.0.4",
+      "brace-expansion@>=4.0.0 <5.0.5": "^5.0.5",
+      "lodash": "^4.18.1"
+    }
+  },
   "license": "MIT"
 }

packages/core/package.json

@@ -31,7 +31,7 @@
     "@vitest/coverage-v8": "^4.1.0",
     "jsdom": "^29.0.1",
     "typescript": "^5.9.3",
-    "vite": "^8.0.1",
+    "vite": "^8.0.9",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.0"
   },

packages/demo/package.json

@@ -20,6 +20,6 @@
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.1",
     "typescript": "^5.9.3",
-    "vite": "^8.0.1"
+    "vite": "^8.0.9"
   }
 }

packages/lib/package.json

@@ -41,7 +41,7 @@
     "jsdom": "^29.0.1",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
-    "vite": "^8.0.1",
+    "vite": "^8.0.9",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.0"
   },