fix: update diff, dompurify, yaml, and solid-js for security patches

- diff: catalog 8.0.2 → 8.0.4, kilo-vscode ^7.0.0 → 8.0.4
  (DoS in parsePatch/applyPatch: GHSA-73rr-hh4g-fpgx)
- dompurify: catalog + packages/ui 3.3.1 → 3.3.3
  (mutation-XSS, XSS, URI bypass: GHSA-h8r8-wccr-v5f2, GHSA-v2wj-7wpq-c8vv,
  GHSA-cjmm-f4jc-qw8r, GHSA-cj63-jhhr-wcxv)
- yaml: kilo-vscode 2.8.2 → 2.8.3
  (stack overflow via nested collections: GHSA-48c2-rrv3-qjmp)
- solid-js: catalog 1.9.10 → 1.9.12
  (fixes seroval transitively: DoS, RCE, prototype pollution)

package.json

@@ -38,8 +38,8 @@
       "@pierre/diffs": "1.1.0-beta.18",
       "@solid-primitives/storage": "4.3.3",
       "@tailwindcss/vite": "4.1.11",
-      "diff": "8.0.2",
-      "dompurify": "3.3.1",
+      "diff": "8.0.4",
+      "dompurify": "3.3.3",
       "drizzle-kit": "1.0.0-beta.16-ea816b6",
       "drizzle-orm": "1.0.0-beta.16-ea816b6",
       "ai": "5.0.124",
@@ -62,7 +62,7 @@
       "@solidjs/meta": "0.29.4",
       "@solidjs/router": "0.15.4",
       "@solidjs/start": "https://pkg.pr.new/@solidjs/start@dfb2020",
-      "solid-js": "1.9.10",
+      "solid-js": "1.9.12",
       "vite-plugin-solid": "2.11.10"
     }
   },

packages/kilo-vscode/package.json

@@ -833,7 +833,7 @@
     "@kilocode/sdk": "workspace:*",
     "@opencode-ai/ui": "workspace:*",
     "@thisbeyond/solid-dnd": "0.7.5",
-    "diff": "^7.0.0",
+    "diff": "8.0.4",
     "dotenv": "^16.4.7",
     "fastest-levenshtein": "^1.0.16",
     "friendly-words": "1.3.1",
@@ -846,7 +846,7 @@
     "solid-js": "^1.9.11",
     "uri-js": "^4.4.1",
     "web-tree-sitter": "^0.24.7",
-    "yaml": "2.8.2",
+    "yaml": "2.8.3",
     "zod": "^3.24.2"
   }
 }

packages/ui/package.json

@@ -54,7 +54,7 @@
     "@solid-primitives/resize-observer": "2.1.3",
     "@solidjs/meta": "catalog:",
     "@solidjs/router": "catalog:",
-    "dompurify": "3.3.1",
+    "dompurify": "3.3.3",
     "fuzzysort": "catalog:",
     "katex": "0.16.27",
     "luxon": "catalog:",