Batched transitive-dependency upgrade to clear high-severity alerts #188

Priority: P1

Context

About 25 packages have high-severity alerts, almost all transitive dev deps, and many are past their Vanta SLA. Fixing them one PR per alert is why they keep coming back. Bump the parent tools first, then pin only what's left.

Do (commit each step separately so a breaking one can be reverted)

1. Bump parent tools:
   • turbo 1.12.4 → latest 2.x (≥ 2.9.14). Migrate turbo.json from pipeline to tasks.
   • typedoc 0.25 → current, plus matching typedoc-plugin-*.
   • semantic-release 23 → current, plus semantic-release-yarn.
2. Run yarn dedupe, then list what's still vulnerable with yarn npm audit --all --recursive.
3. Add resolutions only for what remains. Expected candidates: js-yaml@3 → 3.15.2, brace-expansion (1.x → 1.1.21, 2.x → 2.1.7, 5.x → 5.0.12), ws (7.5.11 / 8.21.0), lodash + lodash-es → 4.18.0, serialize-javascript → 7.0.5, glob → 10.5.0, browserslist → 4.28.7, pacote → 21.5.1, compression → 1.8.2, form-data → 4.0.6, tmp → 0.2.6, sigstore → 4.1.1, braces → 3.0.3, flatted → 3.4.2.

Coordinate with open PRs

• Chore: JS-yaml vulnerability #182 already moves js-yaml 4.x to 4.3.2. Rebase on it or fold it in, but don't duplicate it. It doesn't cover js-yaml 3.x; this issue does.
• chore(deps): minimatch vulnerability #185 covers minimatch. Leave it out of this batch.

Done when

• yarn npm audit --all --recursive --severity high reports no fixable high/critical.
• yarn docs and yarn build pass. Don't run yarn release.

Source: code audit of stackbuilders/assertive-ts at e81a614 (2026-10-13) plus open Vanta/Dependabot findings.