chore: resolve dependabot security alerts

[MarshallOfSound]

Safe-only sweep of open Dependabot security alerts. All changes are transitive refreshes within existing semver ranges (yarn up -R) — no package.json changes, no major bumps, no resolutions entries.

Resolved

Package	Strategy	Version change
path-to-regexp	yarn up -R (within ^8.0.0 via router)	8.3.0 → 8.4.0
body-parser	yarn up -R (dedupe direct + express instance)	2.2.0 / 2.2.1 → 2.2.2
yaml	yarn up -R (within ^2.8.1 via lint-staged)	2.8.2 → 2.8.3
ajv	yarn up -R (within ^6.12.4 via eslint)	6.12.6 → 6.14.0
brace-expansion	yarn up -R (within ^1.1.7 via minimatch)	1.1.12 → 1.1.13

yarn install --immutable passes. npmMinimalAgeGate: 10080 respected (all picked versions are >7 days old).

Flagged (not changed)

These need a breaking change somewhere in the chain and were left alone:

• undici 5.29.0 → 6.24.0 — pulled in via @actions/core@^1.10.0 → @actions/http-client@^2.0.1 → undici@^5.25.4. No 5.x patch exists; reaching 6.x requires @actions/core@3.x (major bump of a direct runtime dep).
• @octokit/request 6.2.8 → 8.4.1 — pulled in via @octokit/rest@^19 / @electron/github-app-auth@^2 / @octokit/graphql@^5. No 6.x backport; fix requires major bumps of @octokit/rest and @electron/github-app-auth (direct runtime deps).
• @octokit/plugin-paginate-rest 6.1.2 → 9.2.2 — via @octokit/rest@^19; same as above.
• @octokit/request-error 3.0.3 → 5.1.1 — via @octokit/rest@^19 / @electron/github-app-auth@^2; same as above.

Clearing the remaining alerts will need a follow-up that bumps @actions/core, @octokit/rest, @octokit/graphql, and @electron/github-app-auth to their current majors together.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	body-parser@​2.2.0 ⏵ 2.2.2	+1	+2

View full report