[benfrank241]

Security bundle for the root package-lock.json (npm). Recreated on a human-authored branch because the equivalent Dependabot PRs (#50 markdown-it, #47 brace-expansion) are red on every check (Dependabot branches get no secrets; Secret Detection fails there too).

Closes

Alert	Package	Advisory	Fix
#52	markdown-it (dev)	GHSA-253c-mchw-3w2r	14.2.0 → 14.3.3
#63	markdown-it (dev)	GHSA-gfr2-rv44-r23c / CVE-2026-111758	same
#64	markdown-it (dev)	GHSA-r7fv-28h4-cvq7 / CVE-2026-111759	same
#65	markdown-it (dev)	GHSA-vfgh-jcmw-g37q / CVE-2026-111766	same
#57	brace-expansion (dev)	GHSA-q2hr-2g5m-vwhr / CVE-2026-102277	2.1.4 → 2.1.7

Both are transitive under typedoc@0.27.8 (markdown-it ^14.1.0, minimatch → brace-expansion ^2.0.2), and the fixed versions are inside those declared ranges, so this is a lockfile-only npm update --package-lock-only — no manifest change, no override. Parsed lock diff: exactly those 2 entries.

Verification

The root package.json has no build/test/lint script and CI (ci.yml) does not install the root package; generate-docs.sh uses its own pinned npx typedoc@0.28.20. So I ran the owning tool directly: npm ci (exit 0 both) and the root node_modules/.bin/typedoc against an identical synthetic TS fixture with markdown doc comments (headings, table, code fence, list) from this branch and from a pristine origin/main worktree. Exit 0 on both; generated HTML trees are byte-identical (diff -r clean).

🤖 Generated with Claude Code

[cdbartholomew]

Superseded by #65, which bumps the root lockfile (markdown-it 14.3.3, brace-expansion 2.1.7, plus toml 5.0.1 and minimatch 11.0.5) as a human-authored PR with full CI and the security label. Closing in favor of #65.