[bndct-devops]

Closes the ten open Dependabot alerts. Lockfiles only, no package.json changes.

frontend/package-lock.json

• fast-uri 3.1.8 -> 3.1.9 (fix(series): keep the action row aligned when the Follow caption shows #106, Crashing when opening books #107, fix(tomesync): never reconstruct foreign annotations on paging documents #108, fix(tomesync): memory-bounded reading-history backfill (build 26) #109)
• serialize-javascript 7.0.5 -> 7.1.4 (feat(tomesync): deterministic book identity + real session clustering (build 27) #110)
• zod 4.3.6 -> 4.6.7 (same advisory as feat(tomesync): series-browser UX batch (build 29) #112, flagged by npm audit)
• prunes an orphaned top-level rolldown entry and its platform bindings; vite 8 uses its own nested rolldown 1.1.5, which is what the build runs on

website/package-lock.json

• undici 8.10.2 -> 8.12.3 (UI polish: home hierarchy, dark contrast, sidebar, loading states #113, Hardcover sync (one-way) + half-star ratings #114, fix(hardcover): language-aware, audio-averse edition pinning #115)
• zod 4.6.2 -> 4.6.7 (feat(tomesync): series-browser UX batch (build 29) #112)
• astro 7.3.2 -> 7.3.8 (feat(tomesync): verify + repair foreign highlights before painting (build 28) #111)

Verified: npm audit reports 0 vulnerabilities in both projects; npm run build passes in both (frontend installed with --legacy-peer-deps, as the Dockerfile and CI do).