fix(deps): bump vulnerable dependencies so pnpm audit passes cleanly (#1338)

* fix(deps): bump vulnerable dependencies

* fix(deps): align web vitest with vite 6

package.json

@@ -40,7 +40,9 @@
   },
   "pnpm": {
     "overrides": {
-      "axios": "^1.15.0"
+      "axios": "^1.15.0",
+      "axios>follow-redirects": "^1.16.0",
+      "external-editor>tmp": "0.2.4"
     }
   }
 }

packages/cli/__tests__/commands/send.test.ts

@@ -167,7 +167,7 @@ describe("send command", () => {
         "-l",
         "fix the bug",
       ]);
-    });
+    }, 15000);
 
     it("skips busy detection with --no-wait", async () => {
       mockTmux.mockImplementation(async (...args: string[]) => {

packages/core/src/__tests__/orchestrator-prompt.dist.test.ts

@@ -59,5 +59,5 @@ describe("generateOrchestratorPrompt dist smoke test", () => {
     expect(prompt).toContain("# My App Orchestrator");
     expect(prompt).toContain("ao session ls -p my-app");
     expect(prompt).toContain("First block\n\n\nSecond block");
-  }, 15000);
+  }, 30000);
 });

packages/web/package.json

@@ -60,7 +60,7 @@
     "@types/react-dom": "^19.0.0",
     "@types/ws": "^8.18.1",
     "@vitejs/plugin-react": "^4.3.0",
-    "@vitest/coverage-v8": "^2.1.0",
+    "@vitest/coverage-v8": "^3.2.4",
     "concurrently": "^9.2.1",
     "jsdom": "^25.0.0",
     "node-gyp": "^12.2.0",
@@ -69,6 +69,7 @@
     "tailwindcss": "^4.0.0",
     "tsx": "^4.19.0",
     "typescript": "^5.7.0",
-    "vitest": "^2.1.0"
+    "vite": "^6.4.2",
+    "vitest": "^3.2.4"
   }
 }

packages/web/src/app/sessions/[id]/page.test.tsx

@@ -282,12 +282,17 @@ describe("SessionPage project polling", () => {
 
     const { default: SessionPage } = await import("./page");
 
-    render(<SessionPage />);
+    render(
+      <TestErrorBoundary>
+        <SessionPage />
+      </TestErrorBoundary>,
+    );
     await flushAsyncWork();
 
     expect(screen.getByText("Session not found")).toBeInTheDocument();
     expect(screen.getByRole("button", { name: "Toggle sidebar" })).toBeInTheDocument();
     expect(screen.queryByTestId("session-detail")).not.toBeInTheDocument();
+    expect(screen.getByTestId("route-error")).toHaveTextContent("NEXT_NOT_FOUND");
   });
 
   it("renders an inline error state instead of throwing the route away", async () => {