Multiple security vulnerabilities in transitive dependencies

Summary

@vis.gl/dev-tools@1.0.1 has multiple high and critical severity vulnerabilities in its transitive dependency tree. These affect all downstream consumers (including deck.gl-community).

Vulnerabilities

Root cause dependencies in dev-tools

These are the direct dependencies that pull in the vulnerable packages:

• coveralls: ^3.0.3 -- pulls in request which pulls in form-data, qs, etc.
• lerna: ^8.1.0 -- pulls in nx (axios), tar, glob
• tap-spec: ^5.0.0 -- pulls in tap-out -> trim
• esbuild: ^0.16.7 -- outdated, current is 0.25.x
• eslint: ^8.52.0 -- deprecated, current is 9.x
• vite: ^4.5.0 -- outdated, current is 7.x

Suggested fixes

1. Drop coveralls -- it depends on the abandoned request package. Modern alternatives: codecov or GitHub Actions coverage reporting
2. Bump lerna to latest or consider replacing with turbo/nx directly
3. Drop tap-spec -- replace with vitest or another modern test reporter
4. Bump esbuild to ^0.25.0
5. Bump eslint to 9.x with flat config
6. Bump vite to ^7.3.1

Context

Found during a security audit of visgl/deck.gl-community. The 1.0.0-alpha.21 and 1.0.1 releases have identical dependency trees, so bumping dev-tools alone does not resolve these.

Start by reviewing the direct dependencies listed in the issue and run the dependency audit to confirm the vulnerable transitive packages and their paths. Decide which upgrades or replacements are compatible with the project, then verify that the audit reports no high or critical vulnerabilities and that the existing tooling still works.