Security: update react-bff lockfiles (68 Dependabot alerts across 3 manifests)

[canuto]

Dependabot reports 68 open alerts in the react-bff template, spread across three lockfiles. These are almost entirely frontend build-chain transitive deps (Vite/Rollup/esbuild/Babel) plus a few library issues — mostly build-time exposure, but the volume is large and easily cleared by refreshing the lockfiles.

Affected manifests

• react-bff/package-lock.json — 34 alerts
• react-bff/my-react-app/package-lock.json — 30 alerts
• react-bff/my-backend/package-lock.json — 4 alerts

Notable packages (highest severity per package)

Severity	Packages
high	vite, rollup, @remix-run/router, glob, minimatch, flatted, lodash
medium	esbuild, postcss, react-router, js-yaml, picomatch, uuid, lodash
low	vite, @babel/core

Most resolve by bumping to current patched minors (e.g. vite ≥ 6.4.x/5.4.x line, rollup ≥ 4.59.0, esbuild ≥ 0.25.0, lodash ≥ 4.18.0).

Proposed fix

For each of the three sub-projects:

cd react-bff && npm audit fix && npm update   # then repeat in my-react-app and my-backend

Then commit the regenerated package-lock.json files. Where npm audit fix won't reach a fix without a major bump (e.g. a Vite major), evaluate the upgrade against the demo app and bump vite/@vitejs/plugin-react together.

Priority

Medium — high alert count but predominantly build-time/dev-chain transitive; no runtime critical.