## Summary

Resolves **10 open Dependabot alerts** across 5 CVEs and dismisses 2
low-severity esbuild alerts as tolerable risk.

### Alerts Fixed

| Alert(s) | Package | Severity | CVE | Fix |
|----------|---------|----------|-----|-----|
| #180, #181 | `tar` | Medium | GHSA-vmf3-w455-68vh | Bump direct pin
`7.5.11` -> `7.5.16` |
| #178, #179 | `form-data` | High | GHSA-hmw2-7cc7-3qxx |
`pnpm.overrides` for `4.0.6` (v4) and `2.5.6` (v2) |
| #172, #176 | `vite` (root) | High + Medium | GHSA-fx2h-pf6j-xcff,
GHSA-v6wh-96g9-6wx3 | Add as direct devDep `^7.3.5` + override |
| #173, #177 | `vite` (docs) | High + Medium | same | `pnpm.overrides`
in docs |
| #174, #175 | `astro` | High + Medium | GHSA-2pvr-wf23-7pc7,
GHSA-jrpj-wcv7-9fh9 | `pnpm update` -> `6.4.8` |

### Alerts Dismissed (tolerable_risk)

| Alert(s) | Package | Severity | Reason |
|----------|---------|----------|--------|
| #167, #168 | `esbuild` | Low | GHSA-g7r4-m6w7-qqqr - Windows
dev-server only vulnerability. Craft is a CLI tool, docs is a static
site. Transitive dep of `[email protected]` which pins `esbuild@^0.27.0` -
cannot fix without vite 8 major bump. |

## Changes

### Root project (`package.json`)
- `tar`: `7.5.11` -> `7.5.16` (direct pin bump)
- `vite`: added as devDependency at `^7.3.5` (was only transitive via
vitest)
- `pnpm.overrides`: added `form-data@>=4: ^4.0.6`, `form-data@<3:
^2.5.6`, `vite: ^7.3.5`

### Docs project (`docs/package.json`)
- `astro`: resolved `5.16.11` -> `6.4.8` (specifier `^6.1.10` allowed
it)
- `@astrojs/starlight`: resolved `0.37.3` -> `0.38.3`
- `pnpm.overrides`: added `vite: ^7.3.5`

## Verification

- `pnpm build` - passed
- `pnpm test` - 1025 passed, 1 skipped
- `pnpm lint` - 0 errors
- `pnpm docs:build` - 27 pages built successfully