Bump vulnerable dev-dep transitives via npm overrides

[david22swan]

Summary

Force-resolves four transitive devDependencies flagged by open Dependabot alerts to their first patched versions, via npm overrides. None of these ship in the published .vsix — uuid and @tootallnate/once arrive through the nyc/codecov coverage chain, serialize-javascript via the test/build tooling, and js-yaml via eslint.

Module	Was	Now	Alerts cleared
serialize-javascript	6.0.0	7.0.5	1 high (RCE, GHSA-5c6j-r48x-rmvq) + 2 medium
js-yaml	4.1.0	4.1.1	1 medium (CVE-2025-64718)
uuid	8.3.2	11.1.1	1 medium (CVE-2026-41907)
@tootallnate/once	1.1.2	2.0.1	1 low (CVE-2026-3449)

Also adds .nyc_output/ to .gitignore (generated by npm run test:coverage, previously untracked).

Why overrides

All four are deep transitive deps whose parents pin older major ranges (uuid is pinned ^8 by nyc/teeny-request; @tootallnate/once pinned "1" by http-proxy-agent@4), so they can't be lifted by bumping a direct dependency. overrides force-resolves them while leaving the direct deps untouched.

Validation

• npm run compile (tsc) — passes
• npm run lint (eslint) — passes
• Smoke-tested the two major bumps for runtime compatibility with the coverage tooling:
  • uuid@11 CommonJS interop: require('uuid').v4() works (the exact pattern nyc/teeny-request use)
  • @tootallnate/once@2 loads
  • an instrumented nyc coverage run completes successfully

The CI test:coverage job is the authoritative check that uuid@11 / @tootallnate/once@2 work end-to-end with nyc + codecov.

Notes

• The mend check will likely stay red until the remaining (non-dev) advisories are addressed — it scans the whole tree.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.77%. Comparing base (1a700c9) to head (8f8c595).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #942   +/-   ##
=======================================
  Coverage   77.77%   77.77%           
=======================================
  Files           1        1           
  Lines           9        9           
=======================================
  Hits            7        7           
  Misses          2        2           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[LukasAud]

LGTM