fix: resolve dependency vulnerabilities and add audit CI

.github/workflows/lint.yml

@@ -25,12 +25,39 @@ jobs:
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-
-      - name: Ensure lint script is executable
-        run: chmod +x scripts/lint.sh tests/test-lint.sh
+      - name: Ensure scripts are executable
+        run: chmod +x scripts/lint.sh scripts/audit.sh tests/test-lint.sh
 
       - name: Run lint smoke tests
         run: pnpm run test:lint
 
       - name: Run documentation lint
         run: ./scripts/lint.sh
+
+  audit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.17.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Ensure audit script is executable
+        run: chmod +x scripts/audit.sh
+
+      - name: Run security audit
+        run: ./scripts/audit.sh

package.json

@@ -8,8 +8,40 @@
   },
   "devDependencies": {
     "cspell": "9.7.0",
-    "eslint": "9.39.1",
-    "eslint-plugin-mdx": "3.6.2",
-    "mint": "4.2.188"
+    "eslint": "10.1.0",
+    "eslint-plugin-mdx": "3.7.0",
+    "mint": "4.2.446"
+  },
+  "pnpm": {
+    "overrides": {
+      "axios": ">=1.13.5",
+      "basic-ftp": ">=5.2.0",
+      "body-parser": ">=1.20.3",
+      "cookie": ">=0.7.0",
+      "express": ">=4.20.0",
+      "flatted": ">=3.4.2",
+      "glob": ">=10.5.0",
+      "js-yaml": ">=4.1.1",
+      "lodash": ">=4.17.23",
+      "mdast-util-to-hast": ">=13.2.1",
+      "minimatch": ">=9.0.7",
+      "path-to-regexp": ">=0.1.12",
+      "qs": ">=6.14.2",
+      "send": ">=0.19.0",
+      "serve-static": ">=1.16.0",
+      "socket.io-parser": ">=4.2.6",
+      "zod": ">=3.22.3"
+    },
+    "auditConfig": {
+      "ignoreCves": [
+        "CVE-2024-28863",
+        "CVE-2026-23745",
+        "CVE-2026-23950",
+        "CVE-2026-24842",
+        "CVE-2026-26960",
+        "CVE-2026-29786",
+        "CVE-2026-31802"
+      ]
+    }
   }
 }