[johncarmack1984]

GitHub's dependency graph does not read bun.lock, so these never became Dependabot alerts. bun audit listed 22 (1 critical, 13 high, 7 moderate, 1 low); it now lists none.

What moved (package.json ranges unchanged)

• seroval and seroval-plugins 1.5.4 -> 1.6.12 (@tanstack/router-core 1.171.15 asks ^1.5.4): clears critical GHSA-p6vx-979v-rg4c and four highs. Held at 1.6.12 rather than 1.7.x, which changes how streams serialize and which TanStack's own lockfile does not test yet (their move to 1.7.1 is perf(router,start): update Seroval to 1.7.1 TanStack/router#8806). The desktop bundle contains no seroval code either way: it only serves SSR hydration.
• vite 8.1.5 -> 8.3.5 (apps/desktop ^8.1.5, apps/site ^8), with rolldown 1.2.15 nested under it, lightningcss 1.33.0 (1.32.0 stays nested under @tailwindcss/node), postcss 8.5.20 -> 8.5.32 (vite asks ^8.5.30) and nanoid 3.3.16 -> 3.3.20 (postcss asks ^3.3.20).
• colord 2.9.3 -> 2.10.0 (apps/desktop ^2.9.3): GHSA-2wm5-q62r-hmrv. The color picker's colord(fill).lighten(x).toRgbString() is unaffected by the 2.9.5 hue normalization, which only changes hue numbers, not RGB output.
• browserslist 4.28.4 -> 4.29.5 (@babel/helper-compilation-targets ^4.24.0), with the data packages its ranges require: baseline-browser-mapping 2.11.34, caniuse-lite 1.0.30001819, electron-to-chromium 1.5.467, node-releases 2.0.60, update-browserslist-db 1.3.4.
• brace-expansion 5.0.7 -> 5.0.12 (minimatch ^5.0.5) and zod 4.4.3 -> 4.6.7 (@tanstack/router-generator ^4.4.3, eslint-plugin-react-hooks).
• apps/desktop's @types/bun goes from latest to ^1.3.14, the version already locked with bun-types 1.3.14, so relocks stop moving it (the Node 26 PR hit this). The lock's desktop workspace version also catches up to package.json (1.12.0 -> 1.18.3); every bun 1.3.3 relock writes that.

Everything here except colord is build or dev tooling: vite, postcss, browserslist and the babel chain build the frontend, brace-expansion sits under eslint, and zod under the router generator and the lint plugin.

GHSAs cleared

• baseline-browser-mapping: GHSA-w5vr-8v7q-w6rv moderate
• brace-expansion: GHSA-mh99-v99m-4gvg high, GHSA-rgw5-rvv9-x895 high, GHSA-qhr7-859c-m2p7 high, GHSA-6j4f-fj2g-mc7p high, GHSA-q2hr-2g5m-vwhr moderate
• browserslist: GHSA-c83g-rgw3-j3cx high, GHSA-73wf-gq98-2v4g high
• colord: GHSA-2wm5-q62r-hmrv moderate
• nanoid: GHSA-2v37-7h3g-55p8 high
• postcss: GHSA-fxqj-rqcc-2cmp moderate
• seroval: GHSA-p6vx-979v-rg4c critical, GHSA-jp82-f5mq-hwhp high, GHSA-97r2-qh9m-474h high, GHSA-wp97-x4hv-qvhp high, GHSA-7rv5-mrxv-xcr9 high
• vite: GHSA-587h-7wmj-h5pm high, GHSA-rq7h-c2jc-7f22 moderate, GHSA-698v-4r3x-3vcv moderate, GHSA-r825-w8mm-5pxw moderate, GHSA-9jrq-w75r-8gcw low
• zod: GHSA-mrhx-c7xc-m3w5 high

How

The lock was written with the pinned bun 1.3.3 except for the browserslist set, zod and brace-expansion, whose entries were spliced in from a bun 1.4.4 update (1.3.3's update adds transitive names to package.json, and 1.4.4's own lockfile also re-hoisted rolldown and babel copies, which this leaves alone). New releases had to be at least 24 hours old; those under three days old (postcss 8.5.32, browserslist 4.29.5, baseline-browser-mapping 2.11.34, electron-to-chromium 1.5.467) were diffed against their previous release: no install scripts and no new network, exec, eval or env reads.

Verification (bun 1.3.3)

• install --lockfile-only leaves the lockfile byte-identical, and install --frozen-lockfile passes.
• apps/desktop: check:tauri-versions, build, typecheck, lint and bun test (20 pass).
• apps/site: typecheck and build.
• desktop.yml's pull_request paths include bun.lock and apps/desktop/**, so the required checks run on this PR.