fix(dependencies): remediate vulnerable npm packages

[drewstone]

Summary

• Upgrade direct Nx, Vite, Vitest, React Router, and PostCSS dependencies to maintained patched releases.
• Refresh the Yarn lockfile and nested npm lockfiles for the leaderboard and migration workspaces.
• Pin vulnerable transitive packages, including axios, form-data, shell-quote, tar, ws, and related advisory paths.
• Remove the unused root @actions/core dependency.

Security scope

The live Dependabot baseline on 2026-09-01 is 9 critical and 94 high alerts (103 critical/high alerts total). The final Yarn and nested npm lock graphs satisfy every critical/high advisory version range; no alert was dismissed. Nested npm workspaces force ws@8.21.3 through package overrides.

Verification

• yarn install --immutable
• yarn nx run-many --all --target=typecheck --outputStyle=static
• yarn nx run-many --all --target=lint --outputStyle=static
• yarn nx run-many --all --target=test --outputStyle=static
• yarn build:tangle-dapp

The repository default branch is develop; no main branch exists.

[tangletools]

✅ Auto-approved drewstone PR — f647d329

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-01T23:45:27Z}