fix: resolve all 14 open Dependabot alerts

[devondragon]

Summary

Clears all 14 open Dependabot alerts (all npm, all dev-scope, all in the root package-lock.json) in one batch. Verified after the update that no vulnerable version remains anywhere in the lockfile.

Alert(s)	Package	Vulnerable	Now	How
#155-159 (5)	undici	7.28.0	7.29.0	pinned by miniflare; fixed by wrangler/vitest-pool-workers bumps
#160	js-yaml	4.3.0	4.3.2	root overrides entry (lerna pins 4.3.0 exactly, even at latest 10.0.1)
#134, #142 (2)	brace-expansion	1.1.14 / 5.0.4	1.1.18 / 5.0.8+	npm update (in-range)
#135	sharp	0.33.5 / 0.34.5	0.35.2	via miniflare from wrangler ^4.127.1
#125, #126 (2)	vite	6.4.2	8.2.2 (via vitest 4)	vulnerable copy gone after vitest-pool-workers bump
#123	ws	8.18.0	8.21.0	via miniflare bumps
#117	vitest	3.0.9 (stray peer hoist)	4.1.10 only	vitest-pool-workers ^0.20.3 supports vitest 4, so the 3.x hoist disappears
#46	wrangler (nested)	4.35.0	4.120.0	vitest-pool-workers ^0.20.3

Changes

• wrangler ^4.109.0 → ^4.127.1 in account-pages, session-state, user-mgmt
• @cloudflare/vitest-pool-workers ^0.8.0 → ^0.20.3 in user-mgmt
• Root package.json: overrides: { "js-yaml": "^4.3.1" }
• vitest.config.ts → vitest.config.mts, migrated from defineWorkersConfig + poolOptions.workers to the new defineConfig + cloudflareTest() plugin API (required by vitest-pool-workers 0.13+; the package is now ESM-only, hence .mts)
• New test/cloudflare-test.d.ts referencing the cloudflare:test ambient types, which the new package no longer exposes via its types field

Notes

• wrangler 4.127.1 and vitest-pool-workers 0.20.3 both depend on miniflare 5.x -alpha builds; that is what Cloudflare currently ships in latest wrangler. The alternative (vitest-pool-workers 0.19.x, miniflare 4.x stable) leaves undici 7.28.0 in the tree, so the alert would stay open.
• All deps are dev-scope; no production Worker code changed.

Verification

• Lockfile rescanned against every advisory range: no vulnerable versions remain
• vitest run in user-mgmt: 7 files, 93 tests, all pass
• tsc --noEmit clean in user-mgmt and session-state

https://claude.ai/code/session_011sL8MCm9Qma4oKkvdZbHu5

[Copilot]

🟡 Changes recommended

The new cloudflare-test.d.ts uses a brittle hard-coded relative path into node_modules, which can break depending on install/hoist layout and should be made resilient.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR batches dev-dependency upgrades (primarily wrangler and @cloudflare/vitest-pool-workers) and updates the user-mgmt Vitest configuration to the newer ESM/plugin-based Cloudflare Workers test integration, with the stated goal of clearing all open Dependabot alerts originating from the root lockfile.

Changes:

• Bumped wrangler to ^4.127.1 across workspace packages, and bumped @cloudflare/vitest-pool-workers to ^0.20.3 in user-mgmt.
• Migrated user-mgmt Vitest config from defineWorkersConfig (.ts) to defineConfig + cloudflareTest() (.mts).
• Added a root overrides entry for js-yaml and introduced a local d.ts reference to restore cloudflare:test ambient typings.

File summaries

File	Description
packages/user-mgmt/vitest.config.ts	Removed old Workers pool config file (replaced by ESM config).
packages/user-mgmt/vitest.config.mts	New ESM Vitest config using cloudflareTest() plugin.
packages/user-mgmt/test/cloudflare-test.d.ts	Adds explicit ambient type inclusion for cloudflare:test.
packages/user-mgmt/package.json	Bumps @cloudflare/vitest-pool-workers and wrangler.
packages/session-state/package.json	Bumps wrangler.
packages/account-pages/package.json	Bumps wrangler.
package.json	Adds overrides to force a non-vulnerable js-yaml.

Review details

• Files reviewed: 6/8 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[devondragon]

Addressed the Copilot review: replaced the hard-coded ../node_modules/... path reference in test/cloudflare-test.d.ts with /// <reference types="@cloudflare/vitest-pool-workers/types/cloudflare-test" />, which resolves through standard node_modules lookup and is resilient to install/hoist layout changes. tsc --noEmit verified clean.