fix: bump vite to 8.0.10 (CVE-2026-39364)

[eran132]

Bumps vite from 8.0.x to 8.0.10 to fix CVE-2026-39364 — server.fs.deny
can be bypassed using query parameters like ?raw or ?import&raw,
allowing the dev server to expose files that should be denied.

Dev-server only — no production runtime impact. The Storybook peer
dependency warning is harmless (Storybook hasn't updated its peer range yet).

Closes Dependabot alert #150

Test plan

• tsc --noEmit
• npm run lint
• npm run test:unit (9/9)
• npx vite build (built in 31s)
• Dev server runs (npx vite --port 5173) and dashboard loads

[github-actions]

Preview: https://s3.amazonaws.com/noam-gaash.co.il/24937154156/open-bus/1840/index.html
Preview Storybook: https://s3.amazonaws.com/noam-gaash.co.il/24937154156/open-bus/1840/storybook/index.html
Test Report (if available): 'https://s3.amazonaws.com/noam-gaash.co.il/24937154156/open-bus/a5917beebb9b5ded97023ca23cf2056c1776d709/test-results/index.html'

[Copilot]

Pull request overview

This PR bumps Vite from 8.0.x to 8.0.10 to address CVE-2026-39364 (dev server server.fs.deny bypass via ?raw / ?import&raw query params), updating the lockfile accordingly.

Changes:

• Update vite devDependency to ^8.0.10.
• Refresh package-lock.json to capture transitive dependency updates pulled in by the Vite bump.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Bumps Vite devDependency to ^8.0.10.
package-lock.json	Updates the resolved Vite version and related transitive packages/metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

After bumping to Vite 8.0.10, Vite’s engines.node requires ^20.19.0 || >=22.12.0 (see package-lock.json). Our package.json currently allows Node >=22.0.0, which includes 22.0–22.11 that Vite will refuse to run on. Consider tightening engines.node (e.g. to >=22.12.0, or to match Vite’s range) to avoid install/runtime failures for developers on early Node 22 minors.

[eran132]

Thanks @copilot. I changed engines.node to >=22.12.0 to match vite's requirement."

[Copilot]

The engines.node constraint has been tightened to >=22.12.0 in commit a5917be, matching Vite 8.0.10's requirement.