[AmrMsCLL]

Resolves all 10 open Dependabot alerts on site/package-lock.json.

Alerts

Alert	Package	Severity	Before	After	How
#2, #3, #4, #5, #6, #7	vite (direct)	1 high, 4 medium, 1 low	8.3.0	8.3.8	vite range raised from ^8.0.16 to ^8.3.8. Same major; @react-router/dev 8.5.1 accepts ^7.0.0 || ^8.0.0.
#10, #11	happy-dom (via @tiptap/html)	high	20.14.6	21.0.4	@tiptap/html 3.31.4 only allows happy-dom ^20.8.9; 3.33.x allows ^21.0.4. Tiptap pins @tiptap/core and @tiptap/pm as exact peers, so the 18 pinned @tiptap/* packages move together from 3.31.4 to 3.33.1.
#9	minimatch (via eslint, @eslint/config-array, @typescript-eslint/typescript-estree)	medium	10.2.6	11.0.8	No parent release accepts 11.x (eslint 10.14.0 still requires ^10.2.6), so overrides scoped to eslint and typescript-eslint.
#1	source-map-js (via postcss, @tailwindcss/node)	high	1.2.1	1.2.2	Lockfile refresh; both parents already accept 1.2.2.

Notes on the upgrades

• vite 8.3.0 to 8.3.8: patch releases, bug fixes only. Brings rolldown 1.2.8 to 1.2.19 and postcss 8.5.28 to 8.5.32.
• happy-dom 21: the breaking change is that CSS file loading and iframe page loading are off by default. server/render.ts only uses generateHTML, which loads neither.
• tiptap 3.31.4 to 3.33.1: no breaking changes listed. @tiptap/extension-collaboration 3.33.0 changes behaviour only when enableContentCheck is set, which PostEditor.tsx does not set. @tiptap/y-tiptap stays at 3.0.9: it satisfies the ^3.0.7 peer range, and 3.2.0 changes how collaborative documents store position data, which does not belong in a security fix.
• minimatch 11: removes makeRe(), Minimatch#regexp and the AST class. The three consumers only call new Minimatch(...).match() and minimatch(). This is the conflict that made the Dependabot security update for minimatch fail: its only update path downgraded @eslint/js from 10.0.1 to 9.39.5.

The overrides can be removed once eslint and typescript-eslint accept minimatch 11.

Checks

• npm ci, npm run typecheck, npx eslint ., npx prettier --check ., npm run build, npm run size (every page within 150 KB)
• server/live-audit.test.ts, server/share.test.ts, server/addresses.test.ts, server/posts.test.ts (covers the happy-dom path in server/render.ts): 23 tests pass
• Server started locally against Redis; public and signed-in pages render, and the post editor mounts, connects live, takes input and saves

Supersedes

#22, #27 and #42. #31 and #43 are the weekly grouped updates and stay open.

Also in this PR

• fix(posts): stamp posts from an injectable clock: server/subscribers.test.ts:280 (digest) has failed on every branch since 2026-11-09T12:01Z, main included. The spec fixes its clock at 2026-11-06 while server/posts.ts stamped published_at from the real clock, so the posts fell outside the digest window. createPosts now takes now like createSubscribers, and the spec passes its clock through. Expectations are unchanged.
• fix(editor): pre-bundle dependencies so the editor does not reload in dev: on a cold Vite cache, the editor's dependencies were discovered only when the post editor first opened; Vite re-optimised and reloaded the page, dropping focus and keystrokes. react-router.config.ts turns on future.unstable_optimizeDeps, so the routes are scanned at startup. Development only; the production build has no optimiser.