fix(deps): resolve 22 npm security vulnerabilities in website and telemetry/ui

[skrawcz]

Runs npm audit fix in both website/ and telemetry/ui/ to resolve Dependabot security alerts.

website/ (16 alerts fixed, 2 remaining)

Package	From	To	Alerts fixed	Severity
next	15.5.12	15.5.18	#160	high
eslint-config-next	15.5.12	15.5.18	aligned with next	-
hono	4.12.8	4.12.18	#176 #175 #172 #168 #167 #162 #157 #156 #155 #154 #153	1 low 10 medium
@hono/node-server	1.19.11	1.19.14	#152	medium
fast-uri	3.1.0	3.1.2	#173 #169	2 high
path-to-regexp	8.0.x	8.4.2	#148 #149	1 high 1 medium
ip-address	10.1.0	removed	#166	medium

Remaining: postcss (#165) bundled inside next, cannot fix without breaking downgrade to next 9.x.

telemetry/ui/ (4 alerts fixed, 4 remaining)

Package	From	To	Alerts fixed	Severity
fast-uri	3.1.0	3.1.2	#174 #170	2 high
@babel/plugin-transform-modules-systemjs	7.29.3	7.29.4	#171	high
next	14.2.14	15.5.15	#159	high (already merged via #739)

Remaining: lodash (#151 #150), postcss (#164), vite (#158) all locked behind react-scripts 5.x (Create React App). Fixing these requires migrating to a modern bundler.

Other

burr/core/graph.py: black formatting fix. The format to fmt rename from #759 left a line that black wants collapsed. Included here since it causes pre-commit failures on every new PR branched off main.

Summary

• 22 of 26 Dependabot alerts resolved
• 4 remaining are blocked by CRA and need a larger migration effort
• Supersedes Dependabot PRs chore(deps): bump next from 15.5.12 to 15.5.15 in /website #738 chore(deps): bump hono from 4.12.8 to 4.12.14 in /website #740 build(deps): bump @hono/node-server from 1.19.11 to 1.19.13 in /website #730 chore(deps): bump next from 14.2.14 to 16.2.3 in /telemetry/ui #737 (can be closed after this merges)

[Copilot]

Pull request overview

This PR updates the website’s npm lockfile as the result of running npm audit fix, aiming to reduce known security vulnerabilities by upgrading affected transitive dependencies.

Changes:

• Upgraded several website/ dependencies in package-lock.json (notably next, hono, @hono/node-server, fast-uri, path-to-regexp, postcss, etc.).
• Refreshed resolved tarballs / integrity hashes to match the upgraded versions.

Files not reviewed (1)

• website/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[skrawcz]

done.

[skrawcz]

done.

[andreahlert]

diff in burr/core/graph.py:107-111 looks like it slipped in via pre-commit, outside the deps scope. mind reverting or calling it out in the body?

next major bump (14 → 15) on the website is lockfile-only, but worth confirming npm run build and a local smoke of the site. CI has no build job for website/.

other than that, 22/26 alerts cleared with an honest table on the 4 stuck behind CRA. lgtm after those two.

[skrawcz]

Thanks for the review!

graph.py change: Yes, that's a pre-commit black formatting fix that slipped in. The format → fmt rename (from #759) made the line short enough for black to collapse it into one line. Main already has this issue (causing pre-commit failures on every new PR), so I included it here rather than a separate PR. Called out in this comment for clarity.

Website build: Confirmed npm run build passes cleanly with the updated deps — static pages generate fine, no issues with the next lockfile bump.