Track post-Wrynose dependency, audit, and parser maintenance

[gcomneno]

After the Wrynose workspace update landed through #524 and #527, it may be useful to track the remaining dependency, npm audit, and parser-maintenance work in one place.

This is intended as a coordination issue, not as a proposal to solve everything in a single PR. I would appreciate maintainer guidance on the preferred direction before opening overlapping dependency or parser PRs.

Current observations:

• The reference integration workspace and documentation references have been updated to Yocto 6.0 / Wrynose via test: fetch split Yocto 6.0 repositories #524 and docs: fetch Yocto 6.0 documentation resources #527.
• A local npm audit check on current staging reports root-level audit warnings.
• A local lockfile-only audit refresh experiment reduced the root audit report from 13 vulnerabilities to 3, made the client audit clean, and left the server audit clean.
• The remaining root audit warnings are transitive through Mocha:
  • mocha@11.7.6 -> diff@7.0.0
  • mocha@11.7.6 -> serialize-javascript@6.0.2
• npm audit fix without --force does not currently resolve those remaining Mocha-related advisories.
• Several dependency and parser-related PRs are already open and may need review, refresh, merge, or closure before opening overlapping work:
  • chore(deps): bump web-tree-sitter from 0.24.6 to 0.26.6 in /server #498
  • chore(deps): bump semver and @types/semver in /client #499
  • chore(deps): bump tar-fs from 2.1.2 to 2.1.4 #471
  • chore(deps-dev): bump @types/vscode from 1.96.0 to 1.109.0 in /client #500
  • chore(deps-dev): bump @types/vscode from 1.96.0 to 1.109.0 in /server #496
  • chore(deps): bump undici from 6.21.0 to 6.21.2 #413
  • chore(deps-dev): bump typescript from 5.7.2 to 5.9.3 #476
  • chore(deps-dev): bump @types/node from 22.10.5 to 24.6.1 #478
  • chore(deps): bump node-pty from 1.0.0 to 1.1.0 in /client #486
  • chore(deps-dev): bump mocha from 11.0.1 to 11.7.3 #479
  • chore(deps): bump form-data from 4.0.1 to 4.0.4 #469
  • chore(deps-dev): bump typescript-eslint from 8.19.1 to 8.45.0 #477
  • chore(deps-dev): bump eslint from 9.17.0 to 9.36.0 #480
  • Auto update references for commits, tags, etc #452
  • Auto update tree-sitter-bash parser info file #460
  • Auto update tree-sitter-bitbake parser info file #295

Possible split, subject to maintainer preference:

1. Review the existing dependency bump PRs and decide which ones should be refreshed, merged, superseded, or closed.
2. Treat the remaining Mocha-related audit warnings separately, since they are not resolved by a normal npm audit fix.
3. Treat web-tree-sitter, tree-sitter-bash, and tree-sitter-bitbake parser maintenance as a separate track.
4. Avoid bundling all dependency, audit, and parser changes into one large PR unless maintainers prefer that approach.

Would you prefer contributors to help by refreshing existing Dependabot PRs one by one, by opening new focused PRs for the remaining audit/parser tracks, or by taking a different route?

[deribaucourt]

I rather prefer reviewing one PR grouping all dependency updates at once when we are lagging so much behind. A round of npm update, npm audit or ncu would be appreciated, while fixing the hiccups that may appear.
Indeed, the tree-sitter update will need a dedicated development, especially tree-sitter-bitbake, which is no longer maintained. Our plan is to take over and bump it to the latest tree-sitter syntax. Mocha is for testing only (dev-dependency), so it can also be tackled separately.
Make sure to bump the dependencies of all our packages, not just the main one (find package.json).