Regenerate the stale package-lock and pin patched versions for the Dependabot-flagged packages (@vitest/browser, form-data, undici, brace-expansion, js-yaml, esbuild, dompurify, @babel/core, vite, @opentelemetry/core via posthog-js). Remove the harmful langsmith override (it forced the vulnerable 0.5.x line) and the zero-effect lodash-es override. Signed-off-by: Sacha Al Himdani <sacha@probo.com>