fix security advisories in dev dependencies

[irahopkinson]

Combined replacement for the two open dependabot security PRs, #55 (vite) and #56 (js-yaml). One lockfile resolution instead of two, and it clears two advisory groups neither dependabot PR touches.

Why not just merge #55 and #56

Dependabot overshot on vite. The advisory range is 7.0.0 - 7.3.3 and 7.3.6 is published, but #55 targets 8.0.16 — a major bump that swaps the build backend from esbuild/rollup to rolldown (and isn't even latest, which is 8.1.5). vite@7.3.6 clears the advisory with no toolchain change.

Both lockfiles fail idempotence. Baseline: npm install --package-lock-only on main with npm 11.6.1 is a no-op. Both PRs diverge from it, in opposite directions:

PR	Churn the first local npm i after merge reintroduces
#56 js-yaml	re-adds 7 stripped "peer": true entries
#55 vite	drops 2 @emnapi/* optional entries and all libc fields (8 ins / 53 del)

Dependabot is resolving with a different npm than CI's node 24. CI passes on both because these fields don't affect installs, but the lock lands dirty.

What this PR changes

package.json: vite ^7.3.2 → ^7.3.6. Everything else is transitive, via npm audit fix.

Package		Advisories
vite	7.3.2 → 7.3.6	GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3
js-yaml	4.1.1 → 4.3.0	GHSA-h67p-54hq-rp68, GHSA-52cp-r559-cp3m
postcss	8.5.8 → 8.5.23	GHSA-qx2v-qp2m-jg93, GHSA-6g55-p6wh-862q, GHSA-r28c-9q8g-f849
esbuild	0.27.3 → 0.28.1	GHSA-g7r4-m6w7-qqqr
brace-expansion	1.1.14 → 5.0.8 (hoisted)	GHSA-jxxr-4gwj-5jf2, GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg

postcss and esbuild are new here — neither dependabot PR addresses them. Remaining lock changes are the 26 @esbuild/* platform binaries, nanoid 3.3.11 → 3.3.16 (postcss transitive), and minimatch/balanced-match hoisting. All 45 changed entries are security-driven; no unrelated bumps.

Not user-facing

The published package declares no dependencies, no peerDependencies, no engines — consumers get zero transitive deps, so none of these reach them. All are devDependencies; js-yaml is only reachable at lint time via @eslint/eslintrc → FlatCompat.

Built dist/index.es.js, dist/index.cjs.js, and dist/index.d.ts are all byte-identical to main, so no version bump is needed.

For contrast, vite 8 does rewrite the shipped bundle: index.es.js 20.7 kB → 13.0 kB, 809 → 386 lines. I checked it functionally — identical .d.ts, same 6 exports, and a 112-assertion runtime digest over both the ESM and CJS bundles matched except the minified class-name letter of VerseRefException (D → N/f, already non-semantic). So vite 8 looks safe when we do want it, just not needed for this advisory.

Verification

Full CI gate locally on node 24 / npm 11.6.1 — npm run lint, npm run prettier:ci, npm run build, npm run test:ci (40/40 passing) — plus:

• lockfile is idempotent: a re-resolve after this change is a no-op
• dist/ byte-identical to main
• npm audit: 4 advisory groups cleared, 1 residual (below)

Known residual

brace-expansion@1.1.16 via @eslint/eslintrc@3.3.5 → minimatch@3.1.5, reported as 3 high (one chain). Deliberately left alone:

• npm audit fix --force "fixes" it by downgrading @eslint/eslintrc to 0.1.0
• an overrides pin of minimatch@^10 reports 0 vulnerabilities but breaks lint — minimatch@10 has no default export and eslintrc imports it as default

It's a dev-only DoS whose input is our own eslint config globs. The real fix is migrating eslint.config.mjs off FlatCompat to native flat config, which would drop both js-yaml and this brace-expansion from the tree entirely — worth its own PR.

Follow-up

Leaving #55 and #56 open; they can be rebased once this merges. If dependabot auto-closes them, the fixes landed correctly.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.40%. Comparing base (615d403) to head (197d4fb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #57   +/-   ##
=======================================
  Coverage   81.40%   81.40%           
=======================================
  Files           4        4           
  Lines         328      328           
  Branches       78       78           
=======================================
  Hits          267      267           
  Misses         39       39           
  Partials       22       22           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.