chore(ui): update vulnerable deps

Closes #754 (closed) Refs #645

Summary

Update the remaining high-severity UI dependency resolutions owned by WI 645 and regenerate the pnpm lockfile with pnpm 8.15.9. Add two lightweight CI jobs: ce-unit-tests (frozen install plus the complete CE unit suite) is required, and ce-dependency-audit (production audit at the high threshold) reports under allow_failure: true because its result depends on the advisory database at run time rather than on the commit.

Vitest is intentionally excluded because GitHub PR 368 already owns that update.

Principal files changed:

• ui/package.json
• ui/packages/ce/package.json
• ui/pnpm-lock.yaml
• ui/.gitlab-ci.yml

Exact version changes

Package	Locked before	Locked after
vite	6.4.2	6.4.3
js-yaml	4.1.1	4.3.1
ws	8.20.1	8.21.0
brace-expansion	1.1.13 / 5.0.6	1.1.18 / 5.0.9
immutable	5.1.5	5.1.8
fast-uri	3.1.2	3.1.5
postcss	8.5.15	8.5.23

The direct Vite and PostCSS declarations are pinned to the audited target versions. Root pnpm overrides enforce the fixed transitive floors.

Advisory evidence

• Vite: GHSA-fx2h-pf6j-xcff (high), whose 6.x branch is <=6.4.2, fixed in 6.4.3.
• js-yaml: GHSA-h67p-54hq-rp68 (medium, >=4.0.0 <=4.1.1) and GHSA-5p4m-2wfm-xmqj (high, >=4.0.0 <4.3.1), which was published on 2026-08-06 and is why the override targets 4.3.1 rather than 4.3.0. GHSA-52cp-r559-cp3m (high) applies to the 3.x branch only and is not present in this tree.
• ws: GHSA-96hv-2xvq-fx4p (high).
• brace-expansion: GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, and GHSA-rgw5-rvv9-x895 (high).
• immutable: GHSA-v56q-mh7h-f735 and GHSA-xvcm-6775-5m9r (high).
• fast-uri: GHSA-v2hh-gcrm-f6hx, GHSA-7p8r-x3mc-p8w7, and GHSA-4c8g-83qw-93j6 (high).
• PostCSS: GHSA-r28c-9q8g-f849 (high) and GHSA-fxqj-rqcc-2cmp (medium).

Compatibility notes

• These are same-major patch/minor build and development dependency changes; no application runtime API or UI behavior change is intended.
• brace-expansion 5.0.9 requires Node 20 or Node 22 and later. This matches the repository node >=20 declaration and Node 22 UI CI image.
• Existing TypeScript 4.8.3 and stylelint 14 peer warnings remain unchanged and belong to WI 645's broader phased frontend upgrade.

Test assertion scope

Commit dca2b61c is required by the newly added complete CE unit gate, not by a dependency runtime behavior change. With the original singular getByText assertion, the suite fails at 130/131 because the existing UI intentionally renders the SE image in both the Docker-image field and explanatory callout. The scoped assertion uses getAllByText(...).toHaveLength(2); its targeted file passes 22/22 tests and the complete suite passes 131/131. No production code changes are included.

Validation evidence

• CYPRESS_INSTALL_BINARY=0 npx -y pnpm@8.15.9 --dir ui install --frozen-lockfile: passed; lockfile resolution was skipped and the workspace was already current.
• npx -y pnpm@8.15.9 --dir ui audit --prod --audit-level high: passed the threshold; one low and one moderate production finding remain.
• Full audit at the high threshold clears every finding in this MR's scope. It exits nonzero only for excluded Vitest 3.2.4 GHSA-5xrq-8626-4rwp (critical), plus two low/moderate findings.
• npx -y pnpm@8.15.9 --dir ui --filter @postgres.ai/ce test: passed, 12 files and 131 tests.
• npx -y pnpm@8.15.9 --dir ui --filter @postgres.ai/ce build: passed with Vite 6.4.3; only existing Sass deprecation and chunk-size warnings were emitted.
• npx -y pnpm@8.15.9 --dir ui --filter @postgres.ai/ce lint: passed.
• Exact lockfile version checks and git diff --check origin/master...HEAD: passed.
• Commits 93c707a9, dca2b61c, and c91000a9 contain SSH signatures; GitLab currently reports verification_status: unknown_key for each signature.

Duplicate reconciliation

• Rechecked all 293 open GitLab work items and all 22 open GitLab merge requests before implementation; no open MR covers this package/advisory/version set.
• Rechecked all three open GitHub mirror PRs. PR 368 covers Vitest only; PRs 367 and 350 do not overlap this dependency set.
• GitHub Dependabot alert enumeration returns HTTP 403, so alert-level deduplication remains incomplete and no absence of alerts is inferred.

Review fixes (post-REV)

• ef51f2f2 — the js-yaml override targeted 4.3.0, which GHSA-5p4m-2wfm-xmqj (high) covers via >=4.0.0 <4.3.1. Bumped to 4.3.1 and relocked; the lockfile delta is the single js-yaml entry. pnpm audit --audit-level high no longer reports a high finding.
• 52f70325 — split ce-unit-and-dependency-audit into required ce-unit-tests and non-blocking ce-dependency-audit, so a newly published CVE cannot red every unrelated UI merge request and master. Coverage is unchanged; only the merge-gating behaviour of the audit step differs.

CI status

The figures below are from pipeline 2735737504 on c91000a9 and predate the two review-fix commits.

• Pipeline 2735737504 passed for commit c91000a9.
• Required unit/audit job 15737315752 passed in 41.6 seconds: frozen install, production audit at the high threshold, and 12 files / 131 CE tests.
• Required CE end-to-end job 15737315757 passed in 108.0 seconds. Review gate, code style, CE image build, and other required jobs also passed.
• Optional shared-preview job 15737315756 failed with npm E404/permission denied for @postgres.ai/shared@4.0.2-pr-1179 under allow_failure: true; WI 745 tracks the credential issue. Build and package steps completed before publish.

Remaining gates

• Reviewer approval and resolution of remaining review discussions are required.
• GitHub PR 368 is open with merge state DIRTY; its mirror check is failing. It must be reconciled or replaced by an authoritative Vitest remediation before the remaining critical development finding is cleared.

No security label was applied.