chore(deps): upgrade dev dependencies and clear the npm audit findings

[kalwalt]

One upgrade PR in place of the five open Dependabot PRs, with the lockfile regenerated once by npm 11 (as CLAUDE.md asks).

What changes

package	from	to	supersedes
vite	8.3.0	8.3.4 (^8.3.4)	#239
vite-plugin-dts	5.1.1	5.1.2 (^5.1.2)	#229
prettier	3.9.8	3.9.10 (~3.9.10)	#238
brace-expansion (via typedoc → minimatch)	5.0.9	5.0.12	#241 (security)
markdown-it (via typedoc)	14.3.0	14.3.2	#240 (security)
source-map-js (via vite → postcss, coverage-v8 → magicast)	1.2.1	1.2.2	(security, no PR yet)

npm audit: 3 findings (2 high, 1 moderate, all in dev dependencies) → 0. npm outdated now lists only TypeScript 7, deliberately.

Why not TypeScript 7

typedoc 0.28.20 — the latest release — declares typescript peer support only up to 6.0.x, so TypeScript 7.0.x cannot install alongside it (ERESOLVE) and npm run docs would break. .github/dependabot.yml now ignores typescript major updates, with that reason and when to drop the entry; minor and patch updates of 6.x still come through. This keeps Dependabot from opening a PR that cannot pass.

GitHub Actions are already on their latest majors (checkout@v7, setup-node@v7, cache@v6, upload-artifact@v7, codecov-action@v7, git-cliff-action@v4), so nothing is pending there.

Verification (on this branch)

• npm test: 33 files passed, 1 skipped; 561 tests passed, 1 skipped
• npm run typecheck, npm run format-check (Prettier 3.9.10 reformats nothing), node scripts/check-license-headers.mjs: clean
• npm run build-ts: OK; declarations emitted (vite-plugin-dts 5.1.2); bundle banner intact
• npm run bench:smoke: 37 collected
• npm run docs: builds; 0 errors, 9 warnings — the same 9 as before the upgrade (unresolved {@link}s in existing TSDoc)
• npm pack --dry-run: 45 files, LICENSES/Apache-2.0.txt included

Dependabot closes its PRs on its own once dev has these versions; any left open will be closed by hand with a link here.

🤖 Generated with Claude Code

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Upgrade development tools and defer incompatible TypeScript majors

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Bump Prettier, Vite, and vite-plugin-dts development dependency ranges to patched releases.
• Suppress TypeScript major Dependabot updates until TypeDoc supports TypeScript 7.

Diagram

graph TD
  Bot["Dependabot npm"] --> Gate{"TypeScript major?"} -->|"No"| Manifest["Dev dependencies"] --> Build["Vite build"]
  Gate -->|"Yes"| Ignore["Defer update"]
  Manifest --> Docs["TypeDoc docs"]

Loading

High-Level Assessment

Updating the existing dev-dependency ranges and narrowly ignoring incompatible TypeScript majors is appropriate; broad suppression or forcing TypeScript 7 would be less reliable. The supplied diff does not include package-lock.json, despite the stated regeneration. Confirm that the regenerated lockfile is part of the PR so installs and the claimed audit result are reproducible.

Files changed (2) +11 / -3

Other (2) +11 / -3

dependabot.ymlDefer TypeScript major-version updates +8/-0

Defer TypeScript major-version updates

• Adds an npm Dependabot rule that ignores only TypeScript major updates. Its comment explains the TypeDoc peer-dependency incompatibility and when to remove the rule; minor and patch updates remain eligible.

.github/dependabot.yml

package.jsonRaise three development-tool version ranges +3/-3

Raise three development-tool version ranges

• Raises the declared minimum versions of Prettier, Vite, and vite-plugin-dts. TypeScript and TypeDoc declarations remain unchanged.

package.json

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗