Fix npm security vulnerabilities

[ditto-integrations]

Summary

• tmp → 0.2.7 (CVE-2026-49982)
• esbuild → 0.28.1 (GHSA-gv7w-rqvm-qjhr)
• vitest → 3.2.6 (CVE-2026-47429)

Resolves: SPO-1046

Workflow run

Note: Target versions are sourced from Tines and may not always
reflect the latest or most appropriate release (e.g. a version may
be deprecated upstream). Please verify that the resolved versions
in lockfiles are suitable.

Test plan

• CI passes
• No new high/critical vulnerabilities in affected lockfiles
• Affected SDK/component builds successfully

Generated by Tines + Claude Code

[Copilot]

Pull request overview

This PR updates npm dependencies/overrides to remediate reported security vulnerabilities across the root package and the Vite TypeScript example app.

Changes:

• Bump tmp override to ^0.2.7 and update root lockfile resolution.
• Update the example app to vitest@^3.2.6 and vite@^7.0.0, and add an esbuild@^0.28.1 override with corresponding lockfile updates.
• Refresh transitive dependency resolutions in the example lockfile consistent with the toolchain upgrades.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 3 comments.

File	Description
package.json	Updates the root tmp override to address the referenced CVE.
package-lock.json	Updates tmp to 0.2.7 in the resolved dependency tree.
examples/vite-typescript-example/package.json	Upgrades example tooling (Vite/Vitest) and adds an esbuild override.
examples/vite-typescript-example/package-lock.json	Captures the upgraded toolchain and updated transitive dependency graph for the example app.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Kristopher Johnson (kristopherjohnson)]

Validated the supported dependency updates and exact-head CI.