A dependency-advisory sweep across the JavaScript, Python and Go repositories

A pass over open dependency advisories bumped the affected packages in every repository that carried them. On the JavaScript side: pickmydegree (vitest, happy-dom, vite, surge), storygen (vitest 4, vite 6, react-router 7), solids-hunter (vitest 4, vite 6.4.3), eclipse-3d-sim, lifechess, agility-trainer and they-live-agent (vitest 4.1.11), platosdf (vitest and its coverage package, 5.0.1), with lockfile refreshes in deck-lovers and express updates in neon-bumper-cars and collective-starship-game.

On the Python and Go side: portcullis (cryptography, paramiko, pytest), caciarabot (pytest 9.x, for the tmpdir advisory), pacenotch (golang.org/x/image, golang.org/x/net), forgepulse (vitest 4.1.11 and echarts 6.1.0), and a routine pytest bump in aristowrap. One removal rode along: collective-starship-game dropped the leftover AI Studio wiring — a GEMINI_API_KEY define and a .env.example nothing read — and uninstalled five dependencies that no module imports.