chore(deps): lock file maintenance

[its-miso]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "before 5am on monday" in timezone America/Edmonton, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

Superseded by a newer automated review for this pull request.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

PR Review: PR 375 chore(deps): lock file maintenance

Recommendation: Approve

This is a standard lock file maintenance PR from Renovate Bot. The CI passed both "Docker Build" and "Validate" checks, confirming the dependency refresh is safe.

---

Change Summary

The lock file refresh touches only package-lock.json with 143 additions and 106 deletions, reflecting updated transitive dependencies. All version bumps are within patch or minor ranges:

Package	Old Version	New Version	Change Type
@csstools/css-color-parser	4.1.3	4.1.7	patch
@emnapi/runtime	1.11.0	1.11.1	patch
@hono/node-server	2.0.4	2.0.5	patch
@typescript-eslint/* (8 pkgs)	8.61.0	8.61.1	minor
baseline-browser-mapping	2.10.36	2.10.37	patch
body-parser	2.2.2	2.3.0	minor
electron-to-chromium	1.5.371	1.5.375	patch
es-to-primitive	1.3.0	1.3.1	patch
eslint	10.4.1	10.5.0	minor
obug	2.1.2	2.1.3	patch
tldts	7.4.2	7.4.3	patch
typescript-eslint	8.61.0	8.61.1	minor
undici	7.27.2	7.28.0	minor

Notably, es-to-primitive now depends on a new es-abstract-get package, which is an internal structural change. The body-parser bump from 2.2.2 → 2.3.0 includes a content-type sub-field normalization in its dependency tree.

---

Required Checks

✅ Check for breaking API changes in updated dependencies

All updated packages are within patch or minor version ranges, which conventionally preserve API compatibility:

• Dev dependencies (@typescript-eslint/*, typescript-eslint, eslint, tldts, undici): No runtime API impact; these are development tooling only.
• Transitive dependencies: The body-parser minor bump and es-to-primitive patch reflect internal refactoring of their own transitive deps (content-type normalization, es-abstract-get addition) — neither constitutes a breaking public API change for consumers.
• No package.json semver constraint changes: All top-level dependencies remain pinned to their existing ranges. The lock file refresh only resolves newer compatible versions within those ranges.

✅ Run full test suite after upgrade

The CI "Validate" check completed successfully. According to the AGENTS.md release-cut process, the Validate step runs npm run lint, npm run typecheck, npm run test, and npm run build. All four validations passed (CI reached success). This satisfies the requirement to run the full test suite after the upgrade.

---

Standards Compliance

• Lock file maintenance: Per AGENTS.md, npm version updates both package.json and package-lock.json as part of the release process. This PR is a Renovate-initiated lock refresh between releases, which is standard and expected.
• CI gating: Lint/typecheck blocks CI per convention, and both passed.
• No source files modified: Only the lock file changed, so no source code conventions apply.

---

Linked Issue Fit

No linked issues were present in the PR body.

---

Unknowns / Needs Verification

• No blockers: The CI Validate step confirmed all checks pass. The lock file changes are within compatible semver ranges.
• Renovate warning note: The PR body notes "Some dependencies could not be looked up." This is a known Renovate limitation for certain private or unavailable packages and does not indicate a problem with the visible dependency updates, which all resolved cleanly.

---

Conclusion

This is a low-risk lock file maintenance PR. All dependency bumps are within compatible semver ranges, CI validation passed, and no breaking API changes are introduced. The changes align with repository conventions for automated dependency refreshes.