fix(security): resolve all open Dependabot alerts

[jgentes]

Summary

• Ran npm audit fix across root, vscode-extension/, and docs-site/
• Resolves 29 open Dependabot alerts (12 high, 17 moderate)
• Only lock files changed — no direct dependency version bumps

Packages updated (transitive)

Package	Locations
undici	root, vscode-extension
path-to-regexp	root, vscode-extension
minimatch	root, vscode-extension
rollup	root, vscode-extension
hono	root, vscode-extension
ajv	root, vscode-extension
picomatch	vscode-extension, docs-site
next	docs-site
brace-expansion	vscode-extension

Test plan

• All 491 tests pass locally

🤖 Generated with Claude Code

---

Note

Medium Risk
Primarily transitive dependency upgrades in lockfiles (including next, wrangler/miniflare/workerd, and undici), which can change runtime/build behavior and Node engine requirements despite no source changes.

Overview
Resolves reported security vulnerabilities by updating only package-lock.json files in the root, docs-site/, and vscode-extension/ via transitive dependency bumps.

Notable lockfile upgrades include next (and associated @next/swc* binaries) for the docs site, and updates around Cloudflare tooling (wrangler, miniflare, workerd) plus common libs like undici, ajv, rollup, path-to-regexp, minimatch, and picomatch.

^{Reviewed by Cursor Bugbot for commit ed61b66. Bugbot is set up for automated code reviews on this repo. Configure here.}