chore(deps): update dependencies to resolve all npm audit CVEs - #11122

Summary

Updates dependencies across all three manifests (root, cli/, docs/) to resolve every open npm CVE — npm audit now reports 0 vulnerabilities in all three lockfiles.

Security fixes

cli/ (also inherited by the root lockfile via pmd: file:cli):

• adm-zip ^0.5.17 → ^0.6.0 — GHSA-xcpc-8h2w-3j85 (crafted ZIP 4GB allocation). Only addLocalFile/writeZip are used; API unchanged, CLI tests pass.
• sharp ^0.34.5 → ^0.35.3 — libvips CVE-2026-33327/33328/35590/35591. Only sharp().metadata() is used; tests pass.
• Removed @types/got — deprecated stub for got v9 that pulled in the critical form-data <2.5.4 advisory (GHSA-fjxv-7rqg-78g4). got v15 ships its own types; nothing imported the stub.
• ws ^8.20.0 → ^8.21.3 (direct) and nested discord-rpc→ws refreshed to 7.5.13 — GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p.
• Transitives refreshed via lockfile: undici, vite 8.0.x, postcss, picomatch, nanoid, brace-expansion, fast-uri, form-data, esbuild 0.28.2.

docs/:

• vitepress ^1.6.4 → ^2.0.0-alpha.19 — vitepress 1.x pins vite 5 / esbuild 0.21, which have unfixable-in-range advisories (GHSA-67mh-4wv8-2f99 and the vite ≤6.4.2 alerts). The 2.x alpha rides vite 8.2 / esbuild 0.25+; npm run build renders the site cleanly. This is the only route to 0 CVEs in docs.
• markdown-it ^14.1.1 → ^15.0.0 — GHSA-6v5v-wf23-fmfq (also clears linkify-it GHSA-v245-v573-v5vm).
• Transitives refreshed: rollup, preact, postcss, nanoid, mdast-util-to-hast.

Non-security updates

• root: eslint ^10.8.1, @antfu/eslint-config ^8.3.0, eslint-plugin-json-schema-validator ^6.3.1, vitest/@vitest/* ^4.1.11, @types/node ^25.9.5
• cli: @inquirer/prompts ^8.6.0, got ^15.1.0, semver ^7.8.5, globby ^16.2.4, ora ^9.4.1, esbuild ^0.28.2, @types/* bumps, vitest family ^4.1.11

Deliberately left out (available majors, not CVE-related)

• typescript 7 (chore(deps): update dependency typescript to v7 #11025), @types/node 26 (chore(deps): update dependency @types/node to v26 #10939), @antfu/eslint-config 9, chalk 6 — all breaking, none needed for security.
• GitHub Actions bumps actions/checkout@v7 (chore(deps): update actions/checkout action to v7 #10938) / actions/setup-node@v7 (chore(deps): update actions/setup-node action to v7 #11024) are workflow updates, untouched here.

ESLint config fix

@antfu/eslint-config 8.3.0 changed unscoped config blocks to default-ignore markdown files (setDefaultIgnores + GLOB_MARKDOWN), which silently disabled the repo's existing markdown/no-multiple-h1 / markdown/heading-increment overrides and resurfaced 6 errors in .github/CONTRIBUTING.md and two activity readmes. The overrides are now scoped to files: ['**/*.md'] in eslint.config.mjs, restoring the previous behavior.

Verification

• npm audit: 0 vulnerabilities in root, cli/, and docs/
• cli: tsc build clean, all 34 vitest tests pass
• docs: vitepress build completes on 2.0.0-alpha.19 (vite 8.2.2)
• Full eslint . on this branch was diffed against a main worktree with the old lockfile: the identical 574 pre-existing errors (mostly ts/no-deprecated — these feed the code-scanning alerts via the SARIF upload; the workflow is continue-on-error) and zero new findings after the config fix.

Notes

• Open Dependabot/Renovate PRs covered by this change (chore(deps): update all non-major dependencies #10771, chore(deps): update dependency ws to v8.21.0 [security] - autoclosed #11008, chore(deps): update dependency adm-zip to ^0.6.0 [security] - autoclosed #11027, chore(deps): update dependency sharp to ^0.35.0 [security] - autoclosed #11046, chore(deps-dev): bump fast-uri from 3.1.0 to 3.1.5 #11084, chore(deps-dev): bump undici from 6.25.0 to 6.28.0 #11085, chore(deps-dev): bump postcss from 8.5.3 to 8.5.26 in /docs #11098) should auto-close on merge.
• The GitHub Security tab also lists code-scanning alerts (ts/no-deprecated, URL-substring-sanitization warnings in various presence.ts files) — those are code issues in individual activities, not dependency CVEs, and are out of scope here.