chore(deps): reduce npm audit vulnerabilities 97→84 (DEVSITE-2481)

[louisachu]

Summary

Bumps low-risk dependency versions to reduce npm install audit vulnerabilities from 97 → 84, without touching @adobe/aio-cli (which is required by the release pipeline and is the source of the remaining, upstream-blocked advisories).

Part of DEVSITE-2481, which flagged 102 security vulnerabilities + deprecated package warnings during the private deploy's npm install.

Changes

Runtime deps (patch-level, same minor line — shipped in dist bundle):

Package	From → To
@adobe/helix-markdown-support	7.1.0 → 7.1.23
@adobe/mdast-util-gridtables	4.0.1 → 4.0.5
@adobe/remark-gridtables	3.0.1 → 3.0.20

Dev-only tooling (not shipped):

Package	From → To
@babel/core	7.24.0 → 7.29.7
rollup	4.12.1 → 4.63.0
mocha	10.3.0 → 10.8.2
lint-staged	15.2.2 → 15.5.2
@typescript-eslint/eslint-plugin + parser	7.1.1 → 7.18.0

Verification

• npm run build — passes
• npm test (Node 24 / lts-krypton) — result unchanged from baseline (8 pre-existing failures present on main too, unrelated to these bumps)
• @adobe/aio-cli — not modified (no downgrade)

Known floor / follow-up

The remaining 84 vulnerabilities are almost entirely bundled inside @adobe/aio-cli@11.1.0 (sigstore/pacote/libnpm/tar/undici). npm audit fix reports these as unfixable and --force only offers a breaking downgrade to aio-cli 7.0.0. Clearing them requires an upstream Adobe aio-cli update, or restructuring how aio-cli is installed — tracked separately.

🤖 Generated with Claude Code

[melissag-ensemble]

Minor / non-blocking: a couple of these bumps leave sibling packages mismatched, so npm can't dedupe and both copies get bundled (no external list in rollup.config.ts):

• hast-util-to-html stays pinned at 9.0.0, but @adobe/helix-markdown-support@7.1.23 now requires a nested 9.0.5.
• @adobe/mdast-util-gridtables stays at 4.0.5, but @adobe/remark-gridtables@3.0.20 requires a nested 4.0.19.

No behavior impact (our render path is markdown→HTML and the affected handler is unchanged), but if you want to keep the bundle lean, bumping the two top-level pins to 9.0.5 and 4.0.19 would dedupe them back to one copy each.

[melissag-ensemble]

.

[melissag-ensemble]

The @adobe/* bumps pull mdast-util-to-hast@13.2.1 transitively while the root still pins 13.1.0 — three copies remain in the tree. Bumping the root pin to 13.2.1 would fully realize the dedup.

LGTM otherwise