Dependency audit cleanup: 7 pre-existing vulnerabilities + deprecation warnings

[JSONbored]

Context

Surfaced 2026-07-24 from a Cloudflare Workers Build log for the loopover-ui worker (a retried build on
#8586's PR) showing npm deprecation warnings during npm clean-install, which prompted a proper
npm audit --audit-level=moderate pass on the root workspace. All pre-existing on main -- not caused
by, or blocking, any PR in flight (none currently touch package.json/package-lock.json).

npm audit: 7 vulnerabilities (1 moderate, 6 high)

Package	Severity	Issue	Fix
postcss (<=8.5.17)	high	Path traversal in previous-sourcemap auto-loading -- arbitrary .map file disclosure (GHSA-r28c-9q8g-f849)	npm audit fix (non-breaking)
tar (<=7.5.20)	moderate	Uncontrolled recursion in mapHas/filesFilter -- stack-overflow DoS via crafted long-path tar (GHSA-r292-9mhp-454m)	npm audit fix (non-breaking)
brace-expansion (<=5.0.7), via minimatch -> @eslint/config-array/@eslint/eslintrc -> eslint	high	DoS via unbounded expansion length (GHSA-mh99-v99m-4gvg)	npm audit fix --force -- bumps eslint to v10.8.0, a breaking change; needs its own PR + full lint-config verification, not a blind force-fix

Deprecation warnings (informational, no CVE)

• whatwg-encoding@3.1.1 -- upstream recommends @exodus/bytes instead (spec-conformant, faster)
• recharts@2.15.4 (apps/loopover-ui) -- 1.x/2.x branches are no longer active upstream; v3 migration
  available (migration guide)
• @esbuild-kit/esm-loader / @esbuild-kit/core-utils -- merged into tsx upstream; likely a transitive
  dep of something still pinning the old split packages -- worth tracing which direct dependency still
  pulls these in

Task

• npm audit fix for postcss + tar (non-breaking) in its own small PR, verify npm run test:ci
  stays green. -- done via overrides bump (tar ^7.5.19->^7.5.21, new postcss: ^8.5.18 entry), see fix(deps): resolve postcss + tar audit findings via overrides #8612.
• Separately: evaluate the eslint v10 bump (npm audit fix --force for brace-expansion) -- split out as sub-issue Bump eslint to v10 to resolve brace-expansion/minimatch DoS chain (GHSA-mh99-v99m-4gvg) #8608.
• Trace and update the @esbuild-kit/* -> tsx transitive dependency. -- split out as sub-issue Trace and replace the @esbuild-kit/* transitive dependency (merged into tsx upstream) #8609.
• Evaluate the recharts v3 migration for apps/loopover-ui (separate scope -- UI-facing, own testing
  pass against the migration guide). -- split out as sub-issue Evaluate recharts v3 migration for apps/loopover-ui #8610.

Not urgent/blocking -- filed for tracking per the maintainer's "something to consider moving forward" note.

[linear-code]

JSO-5949