fix: patch dependency security alerts

[maxatwork]

Summary

• Patch all 12 open Dependabot alerts, plus the js-yaml advisory surfaced by npm audit.
• Refresh compatible lockfile resolutions and extend the integration security regression thresholds.

Dependabot alerts: #62, #63, #64, #65, #66, #67, #68, #69, #70, #71, #72, #73. Additional npm advisory: GHSA-2883-xcg3-v3hh.

Verification

• npm audit --audit-level=moderate: 0 vulnerabilities
• npm run test:packages; npm run test:integration: 5 files, 11 tests passed
• docs Playwright: 3 passed
• npm run lint, npm run typecheck, npm run build, npm run pack:dry-run: passed

---

Summary by cubic

Patches all 12 open Dependabot alerts and the npm-audit js-yaml advisory by updating vulnerable packages in package.json and refreshing package-lock.json. The dependency security regression test now also checks the newly patched packages, including the Vitest advisories (GHSA-82fw-gwwq-j7x9 and GHSA-9crc-q9x8-hgqq) with boundary-range cases.

^{Written for commit 61155d8. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T10:17:30.247944Z	ca52959	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[maxatwork]

Addressed in commit 61155d8. I checked both advisories: GHSA-9crc-q9x8-hgqq has per-major Vitest RCE ranges, while GHSA-82fw-gwwq-j7x9 separately affects stable Vitest and @vitest/mocker releases from 2.1.0 through 4.1.10, including 3.1.x/3.2.x. The guard now includes the older per-major Vitest ranges, retains the distinct newer advisory range, handles affected 5.0.0 prereleases, and tests the boundaries.