fix(server): update echarts for security scan

What changed

Updated ECharts from 5.6.0 to 6.1.0 in both places that pin the chart runtime:

• server/package.json and server/pnpm-lock.yaml
• noora/package.json and noora/aube-lock.yaml

This also updates the transitive renderer package zrender from 5.6.1 to 6.1.0.

Why it changed

The Server workflow security job for PR #11587 failed during the Trivy filesystem scan. Trivy reported CVE-2026-45249 against echarts@5.6.0 in server/pnpm-lock.yaml, with 6.1.0 listed as the fixed version.

The server lockfile update resolves the failing scan. Noora is included because the actual bundled chart hook imports ECharts from Noora’s dependency graph, so updating only the server lock would remove the CI finding while leaving the bundled chart runtime on the vulnerable version.

Root cause

The server and Noora dependency locks still resolved ECharts 5.6.0. Once Trivy’s vulnerability database included CVE-2026-45249, the server security job began failing even though the application code in PR #11587 was unrelated to the dependency.

Validation

• trivy fs --exit-code 1 --skip-files "mix.exs,mix.lock" --skip-dirs "priv/static,node_modules,deps,_build" ./ from server/
• aube check from server/
• aube check from noora/
• aube run build from noora/
• mise run security from server/

No GitHub comments yet.