fix(deps): patch vite and unhead security advisories

.changeset/security-vite-unhead.md

@@ -0,0 +1,15 @@
+---
+"@csrf-armor/core": patch
+"@csrf-armor/express": patch
+"@csrf-armor/nextjs": patch
+"@csrf-armor/nuxt": patch
+---
+
+chore(deps): patch transitive dev dependency security advisories
+
+Bumps pnpm overrides for `vite` (`^6.4.1` → `^6.4.2`) and `unhead` (`>=2.1.11` → `>=2.1.13`) to pull in patched versions. These are dev/build-time dependencies only — no runtime behavior or published API changes.
+
+Addresses:
+- GHSA: Vite arbitrary file read via dev server WebSocket (high, <=6.4.1)
+- GHSA: Vite path traversal in optimized deps `.map` handling (medium, <=6.4.1)
+- GHSA: Unhead `hasDangerousProtocol()` bypass via leading-zero padded HTML entities in `useHeadSafe()` (medium, <2.1.13)

package.json

@@ -54,15 +54,15 @@
     "overrides": {
       "brace-expansion": "^2.0.3",
       "tmp": ">=0.2.4",
-      "vite": "^6.4.1",
+      "vite": "^6.4.2",
       "qs": ">=6.14.2",
       "simple-git": ">=3.32.3",
       "rollup": ">=4.59.0",
       "serialize-javascript": ">=7.0.5",
       "svgo": ">=4.0.1",
       "tar": ">=7.5.11",
       "devalue": ">=5.6.4",
-      "unhead": ">=2.1.11",
+      "unhead": ">=2.1.13",
       "yaml": ">=2.8.3",
       "node-forge": ">=1.4.0",
       "picomatch@>=2.0.0 <3.0.0": "2.3.2",