fix(deps): refresh lockfile to clear all 9 security advisories

[3uzbcqje]

npm audit goes from 9 advisories (7 high, 1 moderate, 1 low) to 0.

	before	after
high	7	0
moderate	1	0
low	1	0

Why these were unprotected

Six of these had open Dependabot security PRs — #40, #42, #43, #44, #45, #46 — which I closed during a Dependabot config consolidation, having misread them as routine version bumps. They are all transitive, lockfile-only updates, so none of them showed up in package.json and none looked like security work from the title.

Closing a Dependabot PR suppresses that exact fix and Dependabot deletes the branch within seconds, so they could not be reopened. Toggling Dependabot security updates off and on did not regenerate them either. The result was seven open alerts, four of them high severity, with nothing tracking them. This restores each one at the version its original PR proposed.

Changes

lodash                                   4.17.23 -> 4.18.1     (was #43)
flatted                                  3.3.3   -> 3.4.4      (was #44)
@babel/core                              7.28.5  -> 7.29.7     (was #45)
@babel/plugin-transform-modules-systemjs 7.28.5  -> 7.29.8     (was #46)
minimatch                                3.1.2   -> 3.1.5      (was #42)
serve / serve-handler                    14.2.5  -> 14.2.6 / 6.1.6 -> 6.1.7  (was #42)
picomatch                                2.3.1   -> 2.3.2, nested 4.0.3 -> 4.0.7  (was #40)
ajv                                      6.12.6  -> 6.15.0     (pre-existing)

ajv was not one of the suppressed ones. npm audit fix skipped it, so it is bumped explicitly — eslint and @eslint/eslintrc require ^6.12.4, which 6.15.0 satisfies.

Scope

package.json is untouched — every one of these is transitive, so this is a lockfile-only change. 28 entries changed, 5 added, 5 removed, out of 792. lockfileVersion stays 3.

Caveat

Generated with npm 12.0.2 / node 26.8.1; CI runs npm 10.2.4 / node 20.20.2 (per .nvmrc, added in #73). Since package.json is unchanged and the lockfile version is the same, the risk of churn is low — but CI is the real check here, so please let it run rather than taking the diff on trust.

Relationship to #72

Independent. #72 is stuck on a separate Dependabot lockfile bug (@rstest/core vendors @rspack/core@2.2.2, which needs @module-federation/* ^0.24.1 || ^2.0.0, absent from the lock). This PR deliberately does not depend on that being fixed first, so the security work is not blocked behind it. There will be some overlap in the lockfile when #72 is recreated; whichever merges second will rebase.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XKNMLCKoVr8Xz1HePmDBXs

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1a96dd9d-8204-4ef8-8242-fb9d1e9bfa1f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}