chore(security): clean cves (#6509)

configs/cargo/Cargo.lock

@@ -2482,9 +2482,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-proto"
-version = "0.24.2"
+version = "0.24.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "447afdcdb8afb9d0a852af6dc65d9b285ce720ed7a59e42a8bf2e931c67bc1b5"
+checksum = "2ad3d6d98c648ed628df039541a5577bee1a7c83e9e16fe3dbedeea4cdfeb971"
 dependencies = [
  "async-trait",
  "cfg-if",

package.json

@@ -15,7 +15,7 @@
   "packageManager": "pnpm@10.0.0",
   "engines": {
     "node": ">=22",
-    "pnpm": ">=9.15.5"
+    "pnpm": ">=10"
   },
   "scripts": {
     "build": "pnpm turbo build --color",
@@ -101,11 +101,13 @@
     "vitest": "3.0.5"
   },
   "pnpm": {
+    "overrides.esbuild": "To address CVE: https://github.com/graphql-hive/console/security/dependabot/259",
     "overrides.csstype": "To fix type check error https://github.com/JedWatson/react-select/issues/5952",
     "overrides.mjml": "Our patch removes html-minifier from mjml-core, we dont need this dependency and its causing false-alarm (CVE https://nvd.nist.gov/vuln/detail/cve-2022-37620)",
     "overrides.ip": "There is no update with fix for ip package, we use fork https://github.com/indutny/node-ip/issues/150#issuecomment-2325961380",
     "overrides.miniflare": "To address CVE: https://github.com/graphql-hive/console/security/dependabot/245",
     "overrides": {
+      "esbuild": "0.25.0",
       "csstype": "3.1.2",
       "mjml-core@4.14.0>html-minifier": "-",
       "mjml-cli@4.14.0>html-minifier": "-",

packages/libraries/external-composition/package.json

@@ -61,7 +61,7 @@
   },
   "devDependencies": {
     "@apollo/composition": "2.9.3",
-    "esbuild": "0.24.2",
+    "esbuild": "0.25.0",
     "fastify": "4.29.0",
     "graphql": "16.9.0"
   },

packages/services/broker-worker/package.json

@@ -11,7 +11,7 @@
     "@cloudflare/workers-types": "4.20241230.0",
     "@types/service-worker-mock": "2.0.4",
     "@whatwg-node/server": "0.9.65",
-    "esbuild": "0.24.2",
+    "esbuild": "0.25.0",
     "itty-router": "4.2.2",
     "toucan-js": "3.4.0",
     "undici": "6.21.1",

packages/services/cdn-worker/package.json

@@ -22,7 +22,7 @@
     "@whatwg-node/server": "0.9.65",
     "bcryptjs": "2.4.3",
     "dotenv": "16.4.7",
-    "esbuild": "0.24.2",
+    "esbuild": "0.25.0",
     "fastify": "4.29.0",
     "graphql": "16.9.0",
     "itty-router": "4.2.2",

packages/web/app/package.json

@@ -130,7 +130,7 @@
     "urql": "4.1.0",
     "use-debounce": "10.0.4",
     "valtio": "1.13.2",
-    "vite": "6.0.11",
+    "vite": "6.1.0",
     "vite-tsconfig-paths": "5.1.4",
     "wonka": "6.3.4",
     "yup": "1.6.1",