chore: refresh lockfile (transitive dep bumps)

[github-actions]

Automated weekly npm update — bumps transitive deps within
their existing semver ranges. Catches drift between the
committed lockfile and current npm advisories before it
hits a release.

Includes a npm audit --audit-level=moderate clean
confirmation. If audit failed, this PR would not have
been opened — investigate manually instead.

Tests run on Node 24 against the updated lockfile.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​react@​19.2.14 ⏵ 19.2.17
	@​vitest/​coverage-v8@​4.1.6 ⏵ 4.1.9
	@​types/​node@​22.19.19 ⏵ 22.19.21			+1
	tsx@​4.22.1 ⏵ 4.22.4	+1		+1
	react@​19.2.6 ⏵ 19.2.7
	ink@​7.0.3 ⏵ 7.0.6	+1		+1	+2
	@​biomejs/​biome@​2.4.15 ⏵ 2.5.0	+1
	vitest@​4.1.6 ⏵ 4.1.9	+3		+22	+3

View full report