feat: show vulnerability warnings for direct dependencies

[Flo0806]

Resolves: #47

---

Summary

Features:

• New server API endpoint /api/osv/vulnerabilities that batch-queries the OSV API for npm packages
• Vulnerability banner in PackageDependencies.vue showing total count and severity breakdown
• Inline security icons next to affected dependencies with tooltip details
• Collapsible vulnerability details in PackageVulnerabilities.vue with expandable list

Refactoring:

• Created shared/utils/severity.ts with global severity color constants and helpers
• Removed duplicate severity definitions across components
• PackageVulnerabilities.vue now uses the shared OSV endpoint instead of direct API calls

Tests:

• tests for severity utils
• tests for tooltip and severity class helpers

Live testing

search for package-json then in detail choose version 5.0.0 you will see the GET package has vulnerabilities. klick on the shield icon jumps to the detail page of GET and shows details.

[vercel]

@Flo0806 is attempting to deploy a commit to the danielroe Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
docs.npmx.dev	Ready	Preview, Comment	Jan 28, 2026 10:34pm
npmx-lunaria	Error		Jan 28, 2026 10:34pm
npmx.dev	Ready	Preview, Comment	Jan 28, 2026 10:34pm

[github-actions]

Lunaria Status Overview

🌕 This pull request will trigger status changes.

Learn more

By default, every PR changing files present in the Lunaria configuration's files property will be considered and trigger status changes accordingly.

You can change this by adding one of the keywords present in the ignoreKeywords property in your Lunaria configuration file in the PR's title (ignoring all files) or by including a tracker directive in the merged commit's description.

Tracked Files

File	Note
i18n/locales/en.json	Source changed, localizations will be marked as outdated.
i18n/locales/fr.json	Localization changed, will be marked as complete. 🔄️
i18n/locales/it.json	Localization changed, will be marked as complete. 🔄️
i18n/locales/zh-CN.json	Localization changed, will be marked as complete. 🔄️

Warnings reference

Icon	Description
🔄️	The source for this localization has been updated since the creation of this pull request, make sure all changes in the source have been applied.