Patch vulnerable build and runtime dependencies (Refs #70)

README.md

@@ -58,7 +58,7 @@ doesn't need a Docker socket or direct access to your game-server files.
 ## Development
 
 The controller uses SvelteKit, TypeScript, and SQLite. The host agent uses the
-Python 3 standard library. For local development, install Node.js 22 and Python 3:
+Python 3 standard library. For local development, install Node.js 22.12+ and Python 3:
 
 ```sh
 npm ci

docs/development/README.md

@@ -10,7 +10,7 @@ does not require a Docker socket or direct access to host filesystems.
 
 ## Run locally
 
-Use Node.js 22 (the container's version), npm and Python 3.
+Use Node.js 22.12+ (the container uses Node.js 22), npm and Python 3.
 
 ```sh
 npm ci
@@ -82,6 +82,13 @@ npm run test:agent
 npm run build
 ```
 
+The `package.json` overrides keep SvelteKit 2 on patched `devalue` 5.x (5.9.4 or
+newer) and `cookie` 0.7.x releases until its dependency ranges include those fixes.
+These dependencies ship in the server bundle even though SvelteKit is a
+development dependency.
+Dependency security checks must include development dependencies: use `npm audit`
+without `--omit=dev`.
+
 `npm run dev` and `npm run build` regenerate the downloadable agent, installer,
 standalone updater and checksum manifest. Builds also bundle report workers
 under `build/reports` and launch preparation under `build/launch`. Development

package.json

@@ -4,6 +4,9 @@
   "description": "T5/T6 Plutonium Zombies fleet manager \u2014 replaces push_scripts.sh with a live web UI",
   "private": true,
   "type": "module",
+  "engines": {
+    "node": "^22.12.0 || >=24.0.0"
+  },
   "scripts": {
     "dev": "vite dev",
     "build": "vite build && npm run build:reports -- --outDir build/reports && npm run build:launch -- --outDir build/launch",
@@ -32,15 +35,21 @@
   },
   "devDependencies": {
     "@sveltejs/adapter-node": "^5.2.9",
-    "@sveltejs/kit": "^2.8.0",
-    "@sveltejs/vite-plugin-svelte": "^4.0.0",
+    "@sveltejs/kit": "^2.70.3",
+    "@sveltejs/vite-plugin-svelte": "^6.2.4",
     "@types/better-sqlite3": "^7.6.11",
     "@types/node": "^22.7.0",
     "svelte": "^5.1.0",
     "svelte-check": "^4.0.0",
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
-    "vite": "^5.4.0",
-    "vitest": "^2.1.0"
+    "vite": "^7.3.7",
+    "vitest": "^4.1.11"
+  },
+  "overrides": {
+    "@sveltejs/kit": {
+      "cookie": "^0.7.2"
+    },
+    "devalue": "^5.9.4"
   }
 }

vite.config.ts

@@ -1,5 +1,5 @@
 import { sveltekit } from '@sveltejs/kit/vite';
-import { defineConfig } from 'vite';
+import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
     plugins: [sveltekit()],