[vishr]

Fixes #396.

Summary

Upgrade the compatible TanStack Router packages together and refresh only their dependency graph:

- @tanstack/react-router 1.170.44 / @tanstack/router-plugin 1.168.45
+ @tanstack/react-router 1.170.46 / @tanstack/router-plugin 1.168.48
- @tanstack/router-core 1.171.37 / @tanstack/router-generator 1.167.43 / @tanstack/router-utils 1.162.3
+ @tanstack/router-core 1.171.39 / @tanstack/router-generator 1.167.46 / @tanstack/router-utils 1.162.4
- seroval 1.6.8 / seroval-plugins 1.6.8
+ seroval 1.7.5 / seroval-plugins 1.7.6

npm view confirms both top-level Router releases use router-core 1.171.39, whose seroval: ^1.6.7 range accepts the fixed release. No override is needed. Router-utils also requires the transitive diff upgrade from 8.0.4 to 9.0.0. Regenerate THIRD_PARTY_NOTICES; rebuilding the embedded UI produces identical committed assets.

Evidence

• Before: just ui-audit reported both seroval advisories, GHSA-f86p-h4j2-7qgj and GHSA-9wx9-5pv9-3349.
  After: just ui-audit reports no vulnerabilities, using only the two existing reviewed ignores in the unchanged Justfile.
• bun install --frozen-lockfile passes without changes.
• CI's complete just check passes on Ubuntu: Gate run. The separate race-test step was still running when this result was recorded.
• Full just check attempted with writable local caches: script tests (177), Go tests, lint, dead-code checks, audit, embedded UI comparison, and notices check pass. Browser tests report 1,451 passed and nine failures in the existing app-lifecycle suite because the sandbox denies Node spawning /bin/ps (EPERM); the failed worker then hangs and must be terminated. This is not a passing local full gate. No unrelated code changes were made.
• just site-build passes separately, including generated documentation, diagram, and site artifact checks.
• Skip the redundant local pre-push check rerun after documenting the sandbox failure; CI runs the full gate independently.

Merge Danger

Door: two-way

Blast Radius: routing

Only Router-related dependency resolutions and the generated license inventory change. The existing audit exceptions remain unchanged.