diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 6eab99898..650ea3fe1 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -15,7 +15,8 @@ jobs:
   content-validation:
     name: Content validation
     runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    # Full-history/LFS checkout, corpus validation, and cleanup share this budget.
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 14d72afe3..514d760cb 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,3 +25,13 @@ Use the Node.js version in the release workflow when changing this tooling, and
 run `node scripts/release/test-release-policy.cjs` and
 `node scripts/release/test-release-safety.cjs` to check release behavior. Preserve
 the ordinary npm lockfile so dependency review and Dependabot can inspect updates.
+
+The release toolchain includes npm's bundled dependencies. The npm 11.21.1
+lock update fixes the bundled `postcss-selector-parser` finding, but its
+`undici` 6.29.0 and `minimatch` 10.2.5 remain affected by
+[Undici advisories](https://github.com/advisories/GHSA-2m5v-pch6-74hx) and
+[the minimatch advisory](https://github.com/advisories/GHSA-g3hv-75wg-m249).
+Track a compatible npm parent release containing Undici 6.29.1 or later and
+minimatch 11.0.1 or later; npm 12.2.1 still bundles the same affected versions.
+Do not treat this partial update as resolving those findings or force a
+minimatch major override across npm's declared consumer ranges.
diff --git a/package-lock.json b/package-lock.json
index 01c1bf24b..88680c85e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2243,9 +2243,9 @@
       }
     },
     "node_modules/npm": {
-      "version": "11.21.0",
-      "resolved": "https://registry.npmjs.org/npm/-/npm-11.21.0.tgz",
-      "integrity": "sha512-Zov8KhamNneiLdELtj5YALtNmJW4L4fCLTzjfpzXG2w6MSHcf0UxgdlK5uloCuksWT+7mGUU7wi79cO6RqivPg==",
+      "version": "11.21.1",
+      "resolved": "https://registry.npmjs.org/npm/-/npm-11.21.1.tgz",
+      "integrity": "sha512-YTzL6QBEJXyHcTu0JiUc7RKMp+mzlJtl7rGLmERaXUQeFHIMc9atdr6G9M9C8vDWbv40epoTQAzNL2/PtZVDhQ==",
       "bundleDependencies": [
         "@isaacs/string-locale-compare",
         "@npmcli/arborist",
@@ -2314,9 +2314,17 @@
         "which"
       ],
       "dev": true,
+      "license": "Artistic-2.0",
+      "workspaces": [
+        "docs",
+        "smoke-tests",
+        "mock-globals",
+        "mock-registry",
+        "workspaces/*"
+      ],
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
-        "@npmcli/arborist": "^9.9.2",
+        "@npmcli/arborist": "^9.9.3",
         "@npmcli/config": "^10.14.0",
         "@npmcli/fs": "^5.0.0",
         "@npmcli/map-workspaces": "^5.0.3",
@@ -2341,11 +2349,11 @@
         "is-cidr": "^6.0.4",
         "json-parse-even-better-errors": "^5.0.0",
         "libnpmaccess": "^10.0.3",
-        "libnpmdiff": "^8.1.13",
-        "libnpmexec": "^10.3.3",
-        "libnpmfund": "^7.0.27",
+        "libnpmdiff": "^8.1.14",
+        "libnpmexec": "^10.3.4",
+        "libnpmfund": "^7.0.28",
         "libnpmorg": "^8.0.1",
-        "libnpmpack": "^9.1.14",
+        "libnpmpack": "^9.1.15",
         "libnpmpublish": "^11.2.1",
         "libnpmsearch": "^9.0.1",
         "libnpmteam": "^8.0.2",
@@ -2461,7 +2469,7 @@
       }
     },
     "node_modules/npm/node_modules/@npmcli/arborist": {
-      "version": "9.9.2",
+      "version": "9.9.3",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -2854,7 +2862,7 @@
       }
     },
     "node_modules/npm/node_modules/brace-expansion": {
-      "version": "5.0.9",
+      "version": "5.0.12",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -3059,7 +3067,7 @@
       }
     },
     "node_modules/npm/node_modules/http-cache-semantics": {
-      "version": "4.2.0",
+      "version": "4.3.0",
       "dev": true,
       "inBundle": true,
       "license": "BSD-2-Clause"
@@ -3146,7 +3154,7 @@
       }
     },
     "node_modules/npm/node_modules/ip-address": {
-      "version": "10.5.0",
+      "version": "10.7.2",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -3228,12 +3236,12 @@
       }
     },
     "node_modules/npm/node_modules/libnpmdiff": {
-      "version": "8.1.13",
+      "version": "8.1.14",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.9.2",
+        "@npmcli/arborist": "^9.9.3",
         "@npmcli/installed-package-contents": "^4.0.0",
         "binary-extensions": "^3.0.0",
         "diff": "^8.0.2",
@@ -3247,13 +3255,13 @@
       }
     },
     "node_modules/npm/node_modules/libnpmexec": {
-      "version": "10.3.3",
+      "version": "10.3.4",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
-        "@npmcli/arborist": "^9.9.2",
+        "@npmcli/arborist": "^9.9.3",
         "@npmcli/package-json": "^7.0.0",
         "@npmcli/run-script": "^10.0.0",
         "ci-info": "^4.0.0",
@@ -3270,12 +3278,12 @@
       }
     },
     "node_modules/npm/node_modules/libnpmfund": {
-      "version": "7.0.27",
+      "version": "7.0.28",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.9.2"
+        "@npmcli/arborist": "^9.9.3"
       },
       "engines": {
         "node": "^20.17.0 || >=22.9.0"
@@ -3295,12 +3303,12 @@
       }
     },
     "node_modules/npm/node_modules/libnpmpack": {
-      "version": "9.1.14",
+      "version": "9.1.15",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.9.2",
+        "@npmcli/arborist": "^9.9.3",
         "@npmcli/run-script": "^10.0.0",
         "npm-package-arg": "^13.0.0",
         "pacote": "^21.0.2"
@@ -3783,7 +3791,7 @@
       }
     },
     "node_modules/npm/node_modules/postcss-selector-parser": {
-      "version": "7.1.4",
+      "version": "7.1.6",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -4101,7 +4109,7 @@
       }
     },
     "node_modules/npm/node_modules/undici": {
-      "version": "6.28.0",
+      "version": "6.29.0",
       "dev": true,
       "inBundle": true,
       "license": "MIT",