fix(deps): resolve all known dependency vulnerabilities (1 critical, 8 high, 7 medium, 1 low)

[krboktv]

Change Summary

What does this PR change?
Fixes all 17 open Dependabot alerts (1 critical, 8 high, 7 medium, 1 low) by upgrading vitest/@vitest/coverage-v8 to ^4.1.10 (critical GHSA-5xrq-8626-4rwp / CVE-2026-47429: arbitrary file read/execute via the Vitest UI server) and js-yaml to 4.2.0, and by refreshing yarn.lock so all vulnerable transitive dependencies resolve to patched versions. yarn audit goes from 64 findings (1 critical, 32 high, 23 moderate, 8 low) to 0; the diff is limited to package.json and yarn.lock.

Package	Old → New	Severity	Method
vitest (+ @vitest/coverage-v8)	4.0.18 → 4.1.10	critical	direct upgrade
flatted	3.3.3 → 3.4.2	high	lockfile refresh
form-data	4.0.5 → 4.0.6	high	lockfile refresh
minimatch	9.0.5 → 9.0.9	high	lockfile refresh
rollup	4.56.0 → removed from tree	high	lockfile refresh (vite 8 uses rolldown)
vite	7.3.1 → 8.1.5	high + medium	lockfile refresh (transitive of vitest)
picomatch	4.0.3 → 4.0.5	high + medium	lockfile refresh
path-to-regexp	8.3.0 → 8.4.2	high + medium	lockfile refresh
js-yaml	4.1.1 → 4.2.0	medium	direct upgrade
qs	6.14.1 → 6.15.3	medium + low	lockfile refresh
ajv	6.12.6 → 6.15.0	medium	lockfile refresh
postcss	8.5.6 → 8.5.20	medium	lockfile refresh
brace-expansion	1.1.11 / 2.0.1 → 1.1.16 / 2.0.3	medium + low	lockfile refresh

Related Issue/Ticket:
GitHub vulnerabilities report [2026-07-20] (#security-alerts)

Testing & Verification

How was this tested?

• Unit tests
• Integration tests
• Manual testing (describe steps)
• Verified on staging

Commands run locally (Node 22, yarn 1.22.22):

• yarn install --frozen-lockfile — clean install, success
• yarn build — passes (cjs + esm TypeScript builds)
• yarn vitest run — 3 test files, 17/17 tests passed
• yarn lint — fails with 2,189 pre-existing prettier errors in the committed dist/ build artifacts; identical count on unmodified main, unaffected by this change
• yarn audit — 0 vulnerabilities (before: 64)

Risk Assessment

Risk Level:

• Low - Minor changes, no operational impact
• Medium - Moderate changes, limited impact, standard rollback available
• High - Significant changes, potential operational impact, complex rollback

Risks & Impact
All changes are confined to devDependencies and the lockfile; the published package's runtime dependencies (@datadog/pprof, debug, p-limit, regenerator-runtime, source-map) are untouched, so there is no impact on consumers. The only notable bumps are dev-only: vitest 4.0 → 4.1 (minor, test runner) which transitively moves vite 7 → 8 and replaces rollup with rolldown — build and full test suite pass on the new toolchain. Rollback is a simple revert of package.json + yarn.lock.