chore: upgrade transitive npm to 11.18.0 for tar security fixes

[mbret]

The update

npm (transitive, via @semantic-release/npm): 11.15.0 → 11.18.0 — lockfile-only, security-motivated. No manifest change; the bump stays inside the existing ^11.6.2 range declared by @semantic-release/npm.

npm bundles its own copy of node-tar, and the copy shipped in 11.15.0 (tar 7.5.15) was flagged by several advisories. Upgrading to npm 11.18.0 moves the bundled tar to 7.5.19, which resolves:

• GHSA-23hp-3jrh-7fpw (critical) — node-tar decompression/parse DoS via unlimited input
• GHSA-8x88-c5mf-7j5w (high) — negative tar entry size causes infinite loop in archive replace
• GHSA-vmf3-w455-68vh (moderate) — PAX size override parser differential (file smuggling)
• GHSA-w8wr-v893-vjvp (moderate) — process crash via PAX numeric path type confusion
• GHSA-gvwx-54wh-qm9j (moderate) — uncaught exception DoS via NUL byte in PAX records

Because tar is bundled inside the npm package, updating tar alone cannot fix these — npm itself has to move, which is why the two are coupled (this shows in the lockfile as the node_modules/npm subtree refresh).

Gates (npm run check, npm run build, npm run test:ci) pass with no new failures: 91 files lint-clean, build green, 23 test files / 134 tests passed. (Verified on Node 22 — the environment had no Node 25 runtime; CI will confirm on the pinned Node 25.)

Pending queue (found this run, one PR each in future runs)

Security (transitive, lockfile-fixable via npm audit fix):

• undici ≤7.27.2 (high) — via jsdom, @semantic-release/github, @actions/http-client
• js-yaml 4.0.0–4.2.0 (high) — via cosmiconfig
• brace-expansion ≤5.0.7 (high) — via minimatch
• sigstore / @sigstore/core / @sigstore/verify (moderate) — via npm toolchain
• @babel/core ≤7.29.0 (low)

Patch:

• @types/react 19.2.15 → 19.2.17
• @vitejs/plugin-react 6.0.2 → 6.0.4
• react / react-dom 19.2.6 → 19.2.8 (lockstep pair)
• vite 8.1.4 → 8.1.5
• vite-plugin-dts 5.0.1 → 5.0.3

Minor:

• @tanstack/react-query + @tanstack/react-query-persist-client 5.100.14 → 5.101.4 (lockstep pair)
• lint-staged 17.0.5 → 17.2.0
• terser 5.48.0 → 5.49.0
• @biomejs/biome 2.4.15 → 2.5.5 — exact pin, treated as deliberate; will need an explicit manifest bump

Major (breaking — still coming, one at a time):

• @testing-library/jest-dom 6.9.1 → 7.0.0
• @types/node 25.9.5 → 26.1.1
• jsdom 29.1.1 → 30.0.0
• typescript 6.0.3 → 7.0.2

Needs manual attention

• tar GHSA-r292-9mhp-454m (moderate) remains after this bump: it needs tar > 7.5.20, but the latest npm 11.x (11.18.0) still bundles 7.5.19, and bundled deps can't be overridden from this repo's lockfile. It will clear when a future npm release bundles a fixed tar; npm audit's only suggested "fix" today is a nonsensical major downgrade of semantic-release to 15.9.3, which I did not take.

---

Generated by Claude Code