Resolve dev-dependency security advisories via lockfile refresh

[ggoranov-smar]

Summary

• Runs npm audit fix (non-force) to update transitive development dependencies, clearing ten open Dependabot alerts.
• Only package-lock.json changed — no direct dependency edits and no overrides were required.
• All four packages are dev-only (linting, testing, build tooling) and are not shipped in the published dist/, so runtime SDK consumers were never exposed. This is CI/dashboard hygiene.

Advisories resolved

Package	Severity	Alerts	Resolved to
js-yaml	high ×2, moderate ×2	4	3.15.0 / 4.3.0
brace-expansion	high	3	1.1.16 / 2.1.2 / 5.0.7
fast-uri	high	2	3.1.4
@babel/core	low	1	7.29.7

Test plan

• npm audit — 0 vulnerabilities remaining
• npm test — all 2084 tests pass across 90 suites
• Confirmed axios untouched (1.18.1), no overlap with Bump axios to ^1.18.0 to resolve six security advisories #198

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Refreshed development-only dependencies to address ten security advisories.
  • Confirmed these dependencies are not included in production distributions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2b1750dd-fc24-435a-9385-1733ead2301f

📥 Commits

Reviewing files that changed from the base of the PR and between d2c7fdb and 6659bfd.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• CHANGELOG.md

---

📝 Walkthrough

Walkthrough

A new Unreleased Security changelog entry documents refreshed transitive development dependencies, resolved advisories, and clarification that these dependencies are not shipped in dist/.

Changes

Security changelog

Layer / File(s)	Summary
Unreleased security entry CHANGELOG.md	Documents development-only lockfile updates addressing advisories in js-yaml, brace-expansion, fast-uri, and @babel/core, excluding them from dist/.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: vitoraykov

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the lockfile refresh to resolve development dependency security advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dev-dep-security-vulns

---

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 29919176337

Warning

No base build found for commit d2c7fdb on mainline.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 97.619%

Details

• Patch coverage: No coverable lines changed in this PR.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	1274
Covered Lines:	1255
Line Coverage:	98.51%
Relevant Branches:	238
Covered Branches:	221
Branch Coverage:	92.86%
Branches in Coverage %:	Yes
Coverage Strength:	1788.14 hits per line

---

💛 - Coveralls