chore: Bump vulnerable deps (#50901)

This PR bumps the vulnerable dependencies `devalue`, `mermaid`,
`@faker-js/faker`, `brace-expansion`, `undici`, `fast-uri` and
`markdown-it`.

It also dedupes `rolldown`, `vite` and various `react-router` deps.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated development and build tooling for Lite Studio, Studio, and the
Vue block, along with tooling used in automated Studio checks. These
changes do not alter app features or workflows, and no new user-facing
capabilities or behavior changes are included. They are limited to the
project’s underlying development setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

apps/lite-studio/package.json

@@ -10,9 +10,9 @@
     "clean": "rimraf build .react-router .turbo tsconfig.tsbuildinfo"
   },
   "dependencies": {
-    "@react-router/fs-routes": "^7.17.0",
-    "@react-router/node": "^7.17.0",
-    "@react-router/serve": "^7.17.0",
+    "@react-router/fs-routes": "^7.18.4",
+    "@react-router/node": "^7.18.4",
+    "@react-router/serve": "^7.18.4",
     "isbot": "^5.1.36",
     "react": "catalog:",
     "react-dom": "catalog:",
@@ -21,7 +21,7 @@
     "ui-patterns": "workspace:*"
   },
   "devDependencies": {
-    "@react-router/dev": "^7.17.0",
+    "@react-router/dev": "^7.17.1",
     "@tailwindcss/vite": "4.2.4",
     "@types/node": "^22",
     "@types/react": "catalog:",
@@ -29,6 +29,6 @@
     "config": "workspace:*",
     "tailwindcss": "catalog:",
     "tsconfig": "workspace:*",
-    "vite": "^7.3.2"
+    "vite": "^8.0.0"
   }
 }

apps/studio/package.json

@@ -175,7 +175,7 @@
   "devDependencies": {
     "@babel/core": "*",
     "@eslint/compat": "^2.1.0",
-    "@faker-js/faker": "^9.9.0",
+    "@faker-js/faker": "^10.6.0",
     "@graphql-codegen/cli": "5.0.5",
     "@graphql-typed-document-node/core": "^3.2.0",
     "@lexical/headless": "0.51.0",

apps/ui-library/package.json

@@ -24,7 +24,6 @@
   "dependencies": {
     "@hookform/resolvers": "^3.1.1",
     "@monaco-editor/react": "catalog:",
-    "@react-router/fs-routes": "^7.4.0",
     "@supabase-labs/y-supabase": "0.1.0",
     "@supabase/postgrest-js": "catalog:",
     "@supabase/vue-blocks": "workspace:*",
@@ -71,7 +70,8 @@
   },
   "devDependencies": {
     "@babel/core": "*",
-    "@react-router/dev": "^7.9.0",
+    "@react-router/dev": "^7.17.1",
+    "@react-router/fs-routes": "^7.18.4",
     "@shikijs/compat": "^1.1.7",
     "@supabase/ssr": "catalog:",
     "@supabase/supabase-js": "catalog:",

blocks/vue/package.json

@@ -27,6 +27,6 @@
     "shadcn": "^4.0.0",
     "tsconfig": "workspace:*",
     "typescript": "catalog:",
-    "vite": "^7.3.2"
+    "vite": "^8.0.0"
   }
 }

e2e/studio/package.json

@@ -19,7 +19,7 @@
     "otpauth": "^9.4.1"
   },
   "devDependencies": {
-    "@faker-js/faker": "^9.9.0",
+    "@faker-js/faker": "^10.6.0",
     "api-types": "workspace:*",
     "tsx": "catalog:"
   }