Bump dependencies to clear security alerts

[George-Payne]

Clears the bulk of the open dependabot security alerts. All transitive build/tooling deps except markdown-it and @babel/core.

• markdown-it 12.3.2 → 14.2.0 (+ markdown-it-anchor 9.2.1, @types/markdown-it 14.1.2) in documentation; pulls linkify-it to 5.x.
• @babel/core 7.24.6 → 7.29.6 in tools/monaco-editor.
• Transitive (yarn up + resolutions): shell-quote, ws, rollup, svgo, glob, picomatch, serialize-javascript, on-headers, tar-fs, @tootallnate/once, minimatch, postcss, tmp, ajv, @babel/plugin-transform-modules-systemjs.
• Residual: tar, ip-address, one ajv copy - pinned by parents to old majors, need upstream tooling upgrades.

[qodo-code-review]

PR Summary by Qodo

Bump tooling/doc dependencies to resolve security alerts

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Upgrade markdown-it stack for docs build to reach patched advisory fixes.
• Bump @babel/core in monaco-editor tooling to clear reported vulnerabilities.
• Add root Yarn resolutions to force patched transitive build dependencies.

Diagram

graph TD
  A["Repo root"] --> B["Yarn resolutions"] --> C["Transitive deps"]
  A --> D["Docs package"] --> E["markdown-it 14"]
  A --> F["Monaco tool"] --> G["@babel/core 7.29"]
  B --> D
  B --> F

  subgraph Legend
    direction LR
    _pkg([Package/config]) ~~~ _deps["Dependency set"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Rely only on direct dependency bumps (no root resolutions)

• ➕ Keeps dependency graph closer to upstream intent
• ➕ Reduces risk of forcing incompatible transitive versions
• ➖ Often cannot clear advisories when vulnerable packages are deeply nested
• ➖ May require many upstream upgrades across tooling packages

2. Upgrade/replace parent tooling that pins vulnerable majors

• ➕ Removes need for long-lived overrides and reduces future maintenance
• ➕ Likely clears the remaining pinned-major alerts (e.g., tar/ip-address/ajv6)
• ➖ Potentially much larger migration (node-gyp / socks / legacy ajv consumers)
• ➖ Higher risk and more CI surface area than this targeted PR

3. Centralize security overrides via Yarn constraints/policies

• ➕ Adds guardrails to prevent regressions and reintroduction of vulnerable ranges
• ➕ Makes intent explicit and reviewable (policy-as-code)
• ➖ Additional setup/learning curve for contributors
• ➖ Still may require occasional resolutions for urgent fixes

Recommendation: The PR’s approach (targeted direct bumps where necessary + root-level resolutions for transitive alerts) is the best low-risk, high-impact option for quickly reducing security exposure without broad tooling migrations. Consider following up with a separate effort to upgrade or replace upstream tools that pin vulnerable majors, which is the only durable way to eliminate the intentionally-residual alerts.

Files changed (3) +14 / -5

Other (3) +14 / -5

package.jsonUpgrade markdown-it stack used by docs +3/-3

Upgrade markdown-it stack used by docs

• Bumps markdown-it from 12.3.2 to 14.2.0 and markdown-it-anchor to 9.2.1 to reach a line with available security fixes. Updates @types/markdown-it to 14.1.2 to match the new major API surface.

documentation/package.json

package.jsonAdd Yarn resolutions to force patched transitive versions +10/-1

Add Yarn resolutions to force patched transitive versions

• Extends root resolutions to pin patched versions of multiple vulnerable transitive dependencies (e.g., serialize-javascript, on-headers, tar-fs, minimatch, postcss, ajv, tmp). This is intended to clear security alerts without changing published runtime surfaces.

package.json

package.jsonBump @babel/core for monaco-editor tooling +1/-1

Bump @babel/core for monaco-editor tooling

• Upgrades @babel/core from 7.24.6 to 7.29.6 within the monaco-editor tooling workspace to clear security advisories affecting build-time dependencies.

tools/monaco-editor/package.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Unsupported ser-javascript override 🐞 Bug ☼ Reliability

Description

Root resolutions forces serialize-javascript to 7.x even though rollup-plugin-terser declares
serialize-javascript as ^4.0.0, so the installed dependency graph violates
rollup-plugin-terser’s declared compatibility constraints. workbox-build depends on
rollup-plugin-terser, so any path that runs workbox-build will execute with this unsupported
combination.

Code

package.json[43]

+        "serialize-javascript": "^7.0.7",

Evidence

The PR adds a root resolution for serialize-javascript@^7.0.7. The lockfile shows
rollup-plugin-terser depends on serialize-javascript@^4.0.0, and workbox-build depends on
rollup-plugin-terser, so the resolution is forcing a major-version override across that dependency
chain.

package.json[36-52]
yarn.lock[10050-10058]
yarn.lock[11647-11668]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The root Yarn `resolutions` forces `serialize-javascript` to `^7.0.7`, but `rollup-plugin-terser` (pulled in by `workbox-build`) declares `serialize-javascript` as `^4.0.0`. This creates an unsupported dependency graph where `rollup-plugin-terser` is run against a major version it did not declare compatibility with.

## Issue Context
This resolution was added as part of the security-alert cleanup.

## Fix Focus Areas
- package.json[36-51]
- yarn.lock[10050-10058]
- yarn.lock[11647-11668]

## Suggested fix
- Prefer upgrading the *parent* toolchain to a version that is compatible with `serialize-javascript@7` (e.g., bump `workbox-build`/`rollup-plugin-terser` chain) **or**
- Change the resolution to a `serialize-javascript` version that satisfies `rollup-plugin-terser`’s declared range (`^4.0.0`).
- Additionally, consider pinning the resolution to an exact version (not a caret range) to avoid silent drift on future installs.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---