chore(deps): Weekly Dependency + Security Sweep (Wk 3) — 3 Dependabot alerts + docs pass

[PAMulligan]

Weekly Dependency + Security Sweep (Wk 3)

Part of the recurring PMDS repos dependency + security maintenance. For a coding agent to remediate and open a PR.

Workflow (per repo standard)

• Review Dependabot / pnpm audit alerts
• Bump outdated + vulnerable deps with pnpm (regenerate pnpm-lock.yaml via pnpm — do NOT hand-edit the lockfile)
• Run the test suite and confirm CI is green
• Honor the minimumReleaseAge guard (do not pull versions newer than the configured cooldown)
• README/docs accuracy pass (see below)
• Open one PR with a Conventional Commits title/message

Open Dependabot alerts (3)

1. js-yaml — Moderate (DoS) — alert #43

• Advisory: GHSA-h67p-54hq-rp68 / CVE-2026-53550 (CWE-407, quadratic-complexity DoS in merge-key handling)
• Location: pnpm-lock.yaml
• Affected >= 4.0.0, <= 4.1.1; patched 4.2.0
• Transitive via @commitlint/cli 20.5.0 → … → js-yaml
• ⚠️ Dependabot cannot auto-fix: latest installable is 4.1.1, earliest fixed is 4.2.0. Fix requires a pnpm override (e.g. pnpm.overrides["js-yaml@>=4.0.0 <4.2.0"]: ">=4.2.0") or waiting for @commitlint to bump. Confirm the override still satisfies @commitlint before landing.

2. @babel/core — Low (arbitrary file read) — alert #37

• Advisory: GHSA-4x5r-pxfx-6jf8 / CVE-2026-49356 (CWE-22 / CWE-200, source-map read via sourceMappingURL)
• Location: pnpm-lock.yaml
• Affected <= 7.29.0; patched 7.29.6
• Transitive via @stryker-mutator/core|typescript-checker|vitest-runner 9.6.1 → … → @babel/core
• ⚠️ Latest installable 7.29.0; earliest fixed 7.29.6 → needs a pnpm override to >=7.29.6. (Workaround if blocked: inputSourceMap: false in Babel options — dev/test only, prefer the upgrade.)

3. esbuild — Low (path traversal on Windows dev server) — alert #44

• Advisory: GHSA-g7r4-m6w7-qqqr (CWE-22)
• Location: templates/astro/pnpm-lock.yaml
• Affected >= 0.27.3, < 0.28.1; patched 0.28.1
• Transitive via astro 6.4.8 → esbuild 0.27.7
• Fix in the Astro template workspace (override esbuild to >=0.28.1, or bump astro if a release pulls the patched esbuild).

README / docs accuracy pass

• Verify the agent count stated in the README matches the actual number of agents in the repo (description currently claims "53 agents" — confirm and correct if drifted)
• Verify version badges (shields) reflect current versions / build status
• Verify install steps run cleanly on a fresh clone (pnpm install + quickstart commands)

PR

• Conventional Commits, e.g.: chore(deps): bump js-yaml, @babel/core, esbuild to patched versions; docs accuracy pass

Note: Dependabot/Dependency graph is currently enabled for Aurelius.

---

Filed as part of the weekly PMDS repos Dependency + Security Sweep.