Refresh transitive dev dependencies to clear npm audit findings

[CBEPX]

Summary

An exact-tag npm ci for v1.7.3 reports six transitive dev/test dependency findings: three moderate and three high. npm audit --omit=dev reports zero production/runtime vulnerabilities, so this did not block the published plugin release.

All reported packages are transitive and currently have fixes available:

• @humanfs/node — moderate
• brace-expansion — high
• browserslist — high
• fast-uri — high
• qs — moderate
• typed-rest-client — moderate via qs

Desired outcome

Refresh the smallest owning direct dev dependencies and lockfile entries that clear the advisories without applying an unreviewed broad npm audit fix.

Acceptance criteria

• Identify the direct dependency chain for each finding.
• Update only the minimum compatible dev/test dependencies and regenerate the lockfile deterministically.
• npm audit --omit=dev remains zero and full npm audit is zero, or any unavoidable residual finding is documented with exact exposure.
• Full npm run check remains green.
• Mutation, lint, typecheck, integration, and E2E tooling behavior is unchanged.
• No runtime dependency is added solely to repair the dev toolchain.

Provenance

Non-blocking follow-up from the reproducible v1.7.3 release artifact build on 2026-09-03.