[y1o1]

Release cut for v0.10.2, a patch for GHSA-27r3-jxmh-p828 (body-parser DoS, high).

Range (git log v0.10.1..HEAD --oneline)

Commit	CHANGELOG entry
3d95aee chore(security): body-parser 2.4.0 and vite 8.3.5 (#204)	Security: body-parser 2.4.0 (rebuild the image). Changed (development only): vite 8.3.5, now a declared devDependency
c7fcafc ci(dependabot): ignore Node major updates of the base image (#203)	Changed (development only): Dependabot no longer proposes a Node major

Checks

• Version: a patch. No behaviour, configuration or wire change; the only production change is body-parser in the lockfile.
• R6 forward-version grep: no matches outside the policy and the CHANGELOG.
• Local checks: pnpm install --frozen-lockfile, typecheck, lint, build, test and audit (no known vulnerabilities) pass.
• E2E gate: the umbrella E2E cannot run at the moment. Every run, the pinned one included, stops building images on a Docker Buildx entitlement for the npmrc build secret (o3co/auth run 40200647774). It is run against this release after the umbrella is fixed, when PROXY_REV is raised.

After merge

1. Tag v0.10.2 on the merge commit.
2. Replace the generated release body with this section.
3. Raise the umbrella's PROXY_REV.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.