chore: remediate residual runtime dependency advisories from superseded #359

[bntvllnt]

Context

PR #359 is a superseded broad Dependabot npm_and_yarn batch and is not the canonical PostCSS remediation route. PR #360 / issue #355 are the narrow PostCSS route.

This issue splits out the runtime/HTTP residual dependency advisories from #359 so they can be remediated from current main without merging or broadening #359.

Scope

From current main, remediate only the runtime/HTTP package advisories represented in #359:

• hono 4.12.5 -> patched floor at least 4.12.18
• @hono/node-server 1.19.11 -> patched floor at least 1.19.13, or 2.0.2 only if the major bump is validated
• express-rate-limit 8.2.1 -> patched floor at least 8.2.2
• axios 1.13.6 -> patched floor at least 1.15.2 / 1.16.1
• follow-redirects 1.15.11 -> patched floor at least 1.16.0
• fast-uri 3.1.0 -> patched floor at least 3.1.2
• ip-address 10.0.1 -> patched floor at least 10.1.1 / 10.2.0

Non-goals

• Do not include PostCSS; chore: replace stale Next/PostCSS security bump PR from current main #355/chore: bump @vllnt/ui postcss security range #360 own that route.
• Do not merge, repair, or broaden chore(deps): bump the npm_and_yarn group across 1 directory with 13 updates #359.
• Do not mix in Vite/glob/build-tool updates or lodash/flatted utility parser updates unless the package manager proves they are inseparable; if inseparable, document that explicitly in the PR body.
• Do not publish or release.

Evidence

pnpm audit --json --audit-level moderate on current main reported advisories for these packages, including high severity entries for express-rate-limit, axios, and fast-uri, and moderate entries for hono, @hono/node-server, follow-redirects, and ip-address.

Acceptance criteria

• Branch starts from current origin/main.
• PR body links this issue using an accepted keyword (Closes #..., Fixes #..., or Related to #...).
• Diff stays limited to dependency manifests/lockfile unless a compatibility fix is required and explained.
• pnpm audit --json --audit-level moderate no longer reports the scoped advisories above, or any remaining advisory is documented as outside this issue's scope.
• Required repo gates are run or explicitly escalated with exact blocker evidence:
  • pnpm -F @vllnt/ui lint
  • pnpm -F @vllnt/ui exec tsc --noEmit --project tsconfig.build.json
  • pnpm build
  • pnpm test:once
• No direct main edits, no force-push, no merge/release.

[github-actions]

This issue is missing a type (Task / Bug / Feature). A maintainer will set one shortly. See CONTRIBUTING.md → Issue types.