[cdbartholomew]

Promote develop → main (High Dependabot fixes)

main lags behind develop, where several HIGH Dependabot fixes have already landed. This promotes them.

HIGH alerts resolved by this promotion

Package	manifest	main (before)	develop (fix)	Alert(s)
toml	package-lock.json	4.3.0	5.0.1	#70, #71, #72
markdown-it	package-lock.json	14.2.0	14.3.3	#63, #64
source-map-js	tests/ts/package-lock.json	1.2.1	1.2.2	#59

NOT resolved here (tracked separately)

• vite (alert chore(security): bump brace-expansion to 2.1.7 (root lockfile) #61, GHSA-587h-7wmj-h5pm): develop carries vite 6.2.6, which is still vulnerable (advisory covers vite <= 6.4.3, patched 6.4.4). A separate security/vite PR against develop bumps it to 6.4.4; this promotion does not fix the vite alert on its own.

All changes are in test tooling under the repo lockfiles; no runtime/client code is affected.

https://claude.ai/code/session_014J7s5yzoVEqoZ8LmnD8bQd

[cdbartholomew]

Closing: abandoning the wholesale develop → main promotion in favor of direct-to-main, scoped security bumps — see #65 (root lockfile) and #66 (tests/ts lockfile), each one PR per lockfile path with the security label.