fix(security): upgrade vite to 5.4.21 with rollup and static-copy fixes

[bierlingm]

Summary

This PR is the primary security fix — it upgrades vite and companion plugins, AND includes a regenerated lockfile from a clean install that resolves most transitive vulnerabilities.

Direct dependency changes (ui/package.json)

• vite ^4.3.5 → ^5.4.21
• @vitejs/plugin-vue ^4.2.3 → ^5.2.4
• vite-plugin-static-copy ^0.13.1 → ^2.3.2
• vite-plugin-checker ^0.8.0 → ^0.11.0

Override added (package.json)

• rollup → ^4.59.0

Lockfile regeneration bonus fixes

The clean install (rm -rf node_modules package-lock.json && npm install) also resolved:

• lodash 4.17.21 → 4.17.23 (prototype pollution fix)
• lodash-es 4.17.22 → 4.17.23
• undici updated via wrangler 4.75.0 (6 vulnerabilities)
• minimatch patched within semver ranges (3.1.5, 5.1.9, 9.0.9)
• svelte + lit-svelte-stores removed entirely from dependency tree
• vue-template-compiler removed from tree

Dependabot Alerts Resolved

Directly by package upgrades (11):

• Feat/notifications page #141, ci(test): replace cache by restore and save #140, Update holochain to 0.2.1  #139, Refactor/UI cleanup #128, Bridging Protocols #89, Consider refactoring DNAs to facilitate data migration between cells in integrity updates #88 — vite
• Collected bugs / quirks identified in internal testing #147, refactor: rename all codebase use of 'clutter' to 'mewsfeed' #115, Regex Invalid when running in launcher (thus app fails to load) #114 — rollup
• UI easter eggs #138, Branching Yarns #86 — vite-plugin-static-copy

By lockfile regeneration (24):

• Refactor Mew input field handling of links #97, Make all additional profile fields & avatar optional #96 — lodash/lodash-es
• Feat/home page discovery #135, Feat/quote styling #134, Feat/pinned yarns #133, Initial TrustGraph integration (frontend)  #132, Initial TrustGraph integration (frontend)  #131, Feat/feed polling #130 — undici
• Feed Filtering #151, feat: do not include my authored mews in my mewsfeed #150, Feature request: Implement ActivityPub #125, Chore/cargo watch #119, Full compatibility with WebKit #117 — minimatch
• Path-based time index #152, feat(ui): persist all data to localStorage #144, chore(ui): change some component names #143, Conduct a discussion on topics related to MewsFeed that Harlan, Matty, and Jost individually have top of mind to then write articles from #142, build(nix): fix involuntary flake updates #136, Refactor MewInputField to use 3rd party rich text editor with plugins #120, Refactor link input ux #106, test #105, Initial TrustGraph integration (backend) #104, [UI] Enable multi-line mews #53 — svelte
• WIP Feat/indexed global rankings #47 — vue-template-compiler

Total: 35 of 38 alerts resolved

Not fixed (blocked on upstream)

• Refactor DNAs to follow patterns used in the scaffolder #87 — electron (hc-spin pins ^29, fix needs ^35)
• Developer documentation #137, NomDeNet Usernames #70 — esbuild (vite 5 pins ^0.21, fix needs ^0.25 — requires vite 6+)

Test plan

• npm install completes without errors
• npm audit shows only 8 remaining (all blocked on upstream)
• npm run build --workspace ui succeeds
• Vite dev server starts correctly
• CI passes

🤖 Generated with Claude Code

[zippy]

Relevance Analysis
Short answer: Marginal value for your runtime use case.

The vulnerabilities this PR fixes fall into categories:

Vite/Rollup/vite-plugin-static-copy (11 alerts) — These are dev server and build tool vulnerabilities (path traversal in dev server, file serving bypasses). They affect the vite dev server and build pipeline, not the built output. In production (local Holochain runtime or HWC), the vite dev server isn't running. These only matter if you expose the dev server on a network during development.

Lockfile transitive fixes (24 alerts):

lodash prototype pollution (4.17.21→4.17.23) — You do depend on lodash at runtime. However, this is a theoretical prototype pollution vector that requires an attacker to control arguments to specific lodash functions. In a Holochain app where input comes from the DHT/zome calls, exploitation is extremely unlikely.
undici — Transitive via wrangler, which is a Cloudflare Workers tool. Not relevant to your Holochain runtime at all.
minimatch — Dev/build tooling only.
svelte/lit-svelte-stores removed — Cleanup of unused transitive deps.
Remaining unfixed — electron (hc-spin, dev only) and esbuild (vite transitive, build only).

Verdict
No runtime security impact — None of these vulnerabilities affect the built UI bundle running inside Holochain or HWC. The vite/rollup/static-copy issues are dev-server-only, and the lodash fix is for a vector that doesn't apply to your input model.
Dev environment hygiene — If you or others run npm run start (vite dev server) on a shared network, the vite path traversal fixes would matter. On localhost-only dev, even that risk is minimal.
Lockfile churn — The regenerated lockfile would conflict with any dependency changes on your lick-fixes branch, creating merge pain.
Recommendation: Skip this PR unless you're specifically trying to clean up Dependabot alerts. The fixes don't protect your users in any runtime scenario. If you do want a clean audit report later, it's easier to do a fresh lockfile regen after your feature work stabilizes.

Closing for now, may update later.