chore: upgrade tshy, vitest, and typescript to latest major versions (#100)

* chore: add CVE-2026-4926 entry to CHANGELOG

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: upgrade tshy, vitest, and typescript to latest major versions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: bump typescript-eslint packages to ^8.58.2 for TypeScript 6 support

The lockfile had stale 8.42.0 which caps TypeScript at <6.0.0, breaking CI.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: mattpodwysocki

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ### Dependencies
 
+- **Upgrade `tshy` to `^4.1.1`, `vitest`/`@vitest/coverage-istanbul` to `^4.1.4`, `typescript` to `^6.0.2`** — removed deprecated `baseUrl` from `tsconfig.base.json` (TS6)
 - **Upgrade `zod` from `^3.25.42` to `^4.3.6`** — migrated all `z.record()` calls to require explicit key schema (`z.string()`), updated test assertions for changed error message format
 
 ## 0.6.0 - 2026-04-01