chore: resolve npm audit vulnerabilities

[sfishel18]

Summary

Resolves all 3 remaining npm audit findings (0 vulnerabilities after this change):

Package	Severity	Fix
picomatch ≤2.3.1 (via lint-staged)	High	updated to patched 2.3.2 within existing semver range
uuid <11.1.1	Moderate	bumped ^10 → ^11.1.1; dropped @types/uuid (v11 ships its own types). Only usage is uuid.v4(), API unchanged
esbuild ≤0.24.2 / 0.27.3–0.28.0	Moderate	bumped devDep to ^0.28.1; added an npm overrides entry forcing tsup's nested copy to 0.28.1 (tsup still pins ^0.27.0)

Also bumps the package version to 0.11.1.

Note: the esbuild advisories only affect its dev-server (serve()) mode, which this repo never uses — exposure was effectively zero, but the picomatch high was a free fix. Remove the overrides entry once tsup ships with esbuild ≥0.28.1.

Related Issues

N/A — routine dependency hygiene.

---

Requester Checklist

Complete these before marking Ready for Review

• I have self-reviewed my own code
• I have added/updated tests that prove my fix/feature works (dependency-only change; existing suites cover it)
• I have included visual proof (screenshot, video, or test output) if applicable
• All CI checks are passing
• PR size is S/M, OR I have justified the size and added a walkthrough
• I have updated documentation if needed (N/A)

Visual Proof

npm audit → found 0 vulnerabilities
npm run build → tsup build success (esbuild 0.28.1)
npm run build:check → clean
npm test → 53 passed (4 files)
npm run test:browser → 2 passed

Size Justification (if L/XL)

Diff is almost entirely package-lock.json churn; package.json changes are 5 lines.

---

Reviewer Checklist

If these are not met, close the tab — this PR is not ready for review

• Requester checklist above is complete
• All CI checks are passing
• Tests adequately cover the changes

[salty-hambot]

Reviewed by Salty Hambot 🤖🧂 — rubric mode

Verdict: ⚠️ concerns

Dimension	Verdict	Notes
correctness	✅ pass	uuid v4() API unchanged v10→v11; @types/uuid removal safe since v11 ships its own types; no logic changes.
security	✅ pass	Addresses audit findings (picomatch, esbuild, uuid); no new attack surface introduced.
privacy	✅ pass	Dependency bump only; no data handling changes.
reliability	✅ pass	No runtime behavior changes; overrides is a standard npm mechanism.
scalability	✅ pass	No algorithmic or resource usage changes.
observability	✅ pass	No logging or instrumentation changes.
clarity/maintainability	⚠️ concerns	npm-only overrides workaround lacks a TODO/tracking comment and won't apply under Yarn/pnpm.
test quality	✅ pass	Dependency-only change; existing suite passing against updated deps is sufficient.

Tidy security-bump PR — the only nag is that the npm-only overrides pin will silently no-op under Yarn/pnpm, so leave a breadcrumb before Future You forgets why it's there.

_{2 finding(s) posted.
💰 Review cost: $0.0920 · 13.7k in / 256 out tokens · ⏱️ 34.7s
💬 To request a re-review, comment @salty-hambot review}

[salty-hambot]

note: The overrides entry here is npm-only. If any contributors (or CI) use Yarn or pnpm, this won't apply and tsup will happily pull in the vulnerable esbuild again. Given the PR description acknowledges this is a temporary measure, worth a comment in the file (or just a note in the README/CHANGELOG) so whoever removes it later knows why it exists. Since the advisory only bites serve() mode, the blast radius is low — but "I'll remember to remove this later" is the most optimistic thing engineers ever say.

[salty-hambot]

praise: Clean dependency hygiene — the @types/uuid removal is the right call since uuid v11 ships its own types, and keeping both is just asking for a type-mismatch headache.