deps: patch high-risk npm CVEs in toolchain dependencies

[benvinegar]

Summary

• upgrade the pi coding agent and Vitest toolchain to pull in patched transitive dependencies
• explicitly bump yaml and file-type to clear the remaining moderate advisories
• reduce npm audit findings from multiple high/critical CVEs to zero

Testing

• npm audit
• npm test
• npm run lint

Notes

• npm run typecheck currently fails in pi/extensions/sentry-monitor.ts after the dependency upgrade; this PR is scoped to dependency/CVE remediation and leaves that follow-up separate.

This PR description was generated by Pi using GPT-5 Codex

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​mariozechner/​pi-coding-agent@​0.52.12 ⏵ 0.73.0	-1		+1
	vitest@​4.0.18 ⏵ 4.1.5			+1
	@​vitest/​coverage-v8@​4.0.18 ⏵ 4.1.5			+11
	file-type@​21.3.0 ⏵ 21.3.4		+3	+1
	yaml@​2.8.2 ⏵ 2.8.4	+1	+2

View full report