Fix high-severity Dependabot alerts (24 packages)

[redaphid]

Summary

Bumps vulnerable dependencies to patched versions to resolve 24 of 31 open high-severity Dependabot alerts.

Packages fixed (old→new)

Package	Old	New	Alerts fixed
nuxt	~3.13.2	3.21.4	DOS via cache poisoning (×2)
wrangler	^3.99.0	^3.114.17	OS command injection
rollup	4.57.1	4.60.4	Arbitrary file write via path traversal
h3	1.12–1.13	1.15.11	SSE injection + request smuggling (×2)
vue-i18n	10.0.5	10.0.8	Prototype pollution
tar	(new)	7.5.15	Path traversal variants (×6 for 7.x instance)
flatted	3.3.1	3.4.2	Prototype pollution via parse()
node-forge	1.3.1	1.4.0	Ed25519/RSA-PKCS forgery + basicConstraints bypass (×4)
simple-git	3.33.0	3.36.0	Remote code execution
defu	6.1.4	6.1.7	Prototype pollution
devalue	5.0.0	5.8.1	Prototype pollution
minimatch	3.1.2/5.1.6/9.0.5	3.1.5/5.1.9/9.0.9	ReDoS (×3)
serialize-javascript	6.0.2	7.0.5	RCE via RegExp.flags
svgo	3.3.2	4.0.1	Billion Laughs DoS
lodash	4.17.21	4.18.1	Code injection via template
lodash-es	4.17.21	4.18.1	Code injection via template
glob	10.3.12	10.5.0	CLI command injection
parse-git-config	3.0.0	(removed)	Prototype pollution — nuxt 3.21 no longer needs it

Blocked (cannot fix without violating policy)

• koa (alert [.WATCH.]full— Subhashree Sahu Viral Video Trending on Social Media NOW miantiao-me/Sink#70): existing pnpm-workspace.yaml override pins koa@2.15.3→2.16.3; needs 2.16.4+ but that override cannot be modified per policy
• tar@6.2.1 (alerts Suggestion: Make this repo as a template repository miantiao-me/Sink#53, Analytics under paywall? miantiao-me/Sink#55, feat: 将固定链接名称抽取到配置中 miantiao-me/Sink#59, analytics issue miantiao-me/Sink#61, doc(Deployment): Update guides for how to deploy. miantiao-me/Sink#80, [Feature Request] Return Shortened Link Directly in JSON Response miantiao-me/Sink#82): giget@1.2.3 (via shadcn-nuxt@0.11.3) requires tar: ^6.2.0; tar 6.x has no patch release; fixing requires either a new override or updating shadcn-nuxt to a version that uses giget 3.x (which uses tar 7.x)

Validation

• corepack pnpm install --frozen-lockfile --ignore-scripts passes
• All new versions confirmed >14 days old (oldest: minimatch 3.1.5 @ 2026-02-25)
• No new overrides added; no pnpm-workspace.yaml changes
• Only 2 manifest changes: nuxt range (too tight to allow 3.16+) and wrangler range (already allowed 3.114.17, but pnpm update bumped it)

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[cloudflare-workers-and-pages]

Deploying sink with    Cloudflare Pages

Latest commit:	3d9ef81
Status:	🚫  Build failed.

View logs