fix(security): resolve critical audit vulnerabilities and replace nuxt-mapbox

[anthuanvasquez]

Summary

Resolves the critical vulnerability reported by pnpm audit by removing the unmaintained nuxt-mapbox wrapper (which dragged in vulnerable transitive @nuxt/devtools versions) and replacing it with native mapbox-gl. Also updates minor dependencies and removes an obsolete Vite override.

Changes

• Mapbox & Security:
  • Replaced nuxt-mapbox wrapper in app/components/sections/MapRD.vue with direct mapbox-gl instantiation (onMounted/onUnmounted)
  • Cleaned up module registration and dead mapbox config from nuxt.config.ts and README.md
  • Removed nuxt-mapbox package and pruned 147 obsolete transitive dependencies, completely resolving the critical @nuxt/devtools RPC vulnerability (GHSA-279x-mwfv-vcqv)
• Dependency Upgrades:
  • Updated @langchain/core (1.2.10), langchain (1.5.11), @types/node (26.5.1), and happy-dom (20.14.3)
  • Added release age exclusion in pnpm-workspace.yaml
• Workspace Cleanup:
  • Removed obsolete vite: ^8.2.2 override in pnpm-workspace.yaml (Nuxt 4 and Vitest 5 now resolve Vite 8 natively)

Verification

• pnpm audit --prod --audit-level high: 0 critical and 0 high vulnerabilities found (Exit 0)
• pnpm test: 44/44 tests passing across 10 test files
• pnpm lint: 0 errors (ESLint and Prettier passed cleanly)

Closes #83

[Copilot]

🟡 Changes recommended

MapRD.vue imports mapbox-gl at module-evaluation time, which is likely to break SSR/prerender for / unless the import is made client-only via lazy/dynamic import.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR addresses pnpm audit critical vulnerabilities by removing the unmaintained nuxt-mapbox wrapper and switching the site’s map section to direct mapbox-gl usage, while also applying a small set of dependency/workspace maintenance updates.

Changes:

• Replace nuxt-mapbox usage with direct mapbox-gl initialization in the MapRD section component.
• Remove nuxt-mapbox module registration and its config from nuxt.config.ts, and update README accordingly.
• Update a few dependencies and adjust pnpm-workspace.yaml settings (including removing an old Vite override).

File summaries

File	Description
README.md	Updates tech stack docs to reflect mapbox-gl instead of nuxt-mapbox.
pnpm-workspace.yaml	Adds minimumReleaseAgeExclude entries and removes the obsolete Vite override.
package.json	Removes nuxt-mapbox, bumps a few deps, and relies on mapbox-gl directly.
nuxt.config.ts	Drops nuxt-mapbox module registration and its config block.
app/components/sections/MapRD.vue	Reimplements the map section using direct mapbox-gl API calls.

Review details

Suppressed comments (1)

app/components/sections/MapRD.vue:16

• After switching to a lazy client-side import, the map initialization should await the dynamic import and ensure it only runs on the client. This avoids SSR/prerender crashes and keeps the component safe in Node environments.

onMounted(() => {
  if (!accessToken || !mapContainer.value) return;

  mapboxgl.accessToken = accessToken;
  map = new mapboxgl.Map({
    container: mapContainer.value,

• Files reviewed: 5/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.