chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 7 open Dependabot security alerts by adding/updating yarn resolutions for vulnerable transitive dependencies

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#60	undici	high	Bumped to 6.27.0 via yarn resolution >=6.27.0 <7
#59	tar	medium	Bumped to 7.5.21 via yarn resolution >=7.5.16
#62	undici	medium	Covered by undici resolution above
#66	js-yaml	medium	Bumped to 3.15.0 via yarn resolution >=3.15.0 <4
#61	undici	low	Covered by undici resolution above
#63	undici	low	Covered by undici resolution above
#64	@babel/core	low	Bumped to 7.29.7 via yarn resolution >=7.29.6 <8

All four packages are transitive dependencies (none are direct deps in package.json), so yarn resolutions are used to force patched versions. Bounded ranges (<7, <4, <8) keep within the same major version to avoid breaking changes.

All existing tests pass.

[Copilot]

Pull request overview

This PR resolves open Dependabot security alerts by forcing patched versions of vulnerable transitive dependencies via Yarn resolutions, updating yarn.lock accordingly.

Changes:

• Added/updated Yarn resolutions for @babel/core, js-yaml, tar, undici, and undici-types.
• Updated yarn.lock to reflect the newly selected patched package versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds/updates resolutions entries to force patched dependency versions.
yarn.lock	Lockfile updates to reflect the resolved versions selected by Yarn.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.