[geoffturk]

Summary

Clears 22 of the 24 open Dependabot alerts. All of them are denial-of-service or ReDoS advisories in build-time tooling, so nothing here reaches the published site, but the alerts were accumulating because the weekly Dependabot version-update PRs only follow package.json entries and never touch nested transitive copies in the lockfile. Dependabot security updates are now enabled on the repo as well, so future transitive alerts will arrive as PRs instead of sitting open.

Changes

• Bump toml from 4.3.0 to 5.0.1, the only direct dependency with an open alert (three quadratic-complexity DoS advisories in toml.parse()). The frontmatter transformer only calls toml.parse(), and 5.x keeps that API, so no code change is needed.
• Run npm audit fix to refresh the transitive copies: brace-expansion 1.1.14 to 1.1.21 and 5.0.9 to 5.0.12, js-yaml 3.14.1 to 3.15.2 (under gray-matter), immutable 5.1.5 to 5.1.9, picomatch 2.3.1 to 2.3.2, source-map-js 1.2.1 to 1.2.2, and fflate 0.7.4 to 0.7.5.

Not addressed

Two alerts remain and need major bumps in upstream packages: katex 0.16 to 0.18 (via rehype-katex and remark-math) and the fflate 0.7.3 copy that satori pins exactly. Both are build-time only and are candidates for dismissal as tolerable risk.

Verification

In a node:22-slim container: clean npm ci, a TOML frontmatter smoke test against toml 5.0.1, npm test with 78 of 78 passing, and a full quartz build of all 57 content files. Note that npm run check already fails on v4 because TypeScript 6 rejects the deprecated moduleResolution=node10 setting in tsconfig.json; that predates this change and is left alone here.