just audit found something in dev's dependencies #410

Agent Brief

Summary. just audit fails on dev as of 049e1b1, in both trees. Seen on the audit run of PR #402 and on the run of #397's pull request, so it comes from new advisories, not from either change.

Read each one before acting on it: npm's suggested remedy is routinely a downgrade. An advisory judged not to apply goes in deny.toml or ui/npm-audit-exceptions.json with its reason (AGENTS.md, Dependencies).

Rust (cargo-deny), three advisories about trusting certificates Kamosu should not:

All three are patch releases within the versions Cargo.toml already allows, so cargo update -p rustls-webpki -p webpki-roots -p webpki-root-certs should move only Cargo.lock. That is the advisory exception to holding versions that AGENTS.md describes, not an upgrade.

The interface (npm audit), one above the bar:

• high GHSA-587h-7wmj-h5pm: launch-editor's existence check can be bypassed on Windows, in vite 8.2.2.
• Below the bar, to read and not obey: two moderate launch-editor advisories in vite (GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw) and a low one in cookie (GHSA-pxg6-pf52-xh8x).
• vite is a dev dependency: launch-editor opens a file in an editor from the dev server's error overlay, and nothing that ships carries it. Whether a patched vite exists within its current major, or whether this is an exception with its reason, is this ticket's to find out. The existing braces exception (GHSA-vfj7-8cjw-p6xm) still holds and is not part of this.

Desired state. just audit passes on dev: each advisory either fixed by a lockfile move, or recorded as judged not to apply with its reason. just check and just test pass on the result.

Changelog. None unless a fix changes what a person running Kamosu sees.