chore: resolve dependabot security alerts

[MarshallOfSound]

Safe-only sweep of open Dependabot security alerts. All bumps are lockfile-only (yarn up -R) within existing semver ranges — no package.json changes, no resolutions added.

Package	Strategy	Version change
markdown-it	yarn up -R (direct dep, within ^14.1.0)	14.1.0 → 14.1.1
minimatch	yarn up -R (transitive via glob, test-exclude)	9.0.5 → 9.0.9
picomatch	yarn up -R (transitive via vite, vitest, tinyglobby)	4.0.3 → 4.0.4
brace-expansion	yarn up -R (transitive via minimatch)	2.0.2 → 2.0.3
yaml	yarn up -R (transitive via lint-staged)	2.8.2 → 2.8.3

All selected versions are ≥7 days old (satisfies npmMinimalAgeGate: 10080).

yarn install --immutable passes and yarn npm audit --all --recursive is now clean.

Flagged (not changed)

None — everything resolved within existing ranges.

Notes

• picomatch@2.3.2 (via micromatch) is outside the vulnerable range (>= 4.0.0, < 4.0.4) and was left as-is.
• The existing peer-dependency warning (@vitest/coverage-v8@3.0.5 vs vitest@^4.0.18) predates this PR and is unrelated.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	markdown-it@​14.1.0 ⏵ 14.1.1	+1	+2	+1

View full report