chore(deps): refresh lockfile to clear all open security advisories

[pifantastic]

Clears all 20 open Dependabot alerts. pnpm audit goes from 13 high / 6 moderate / 2 low to no known vulnerabilities.

None of the open Dependabot PRs would have fixed these — every alert is on a transitive dependency, so the fix is a lockfile/override change rather than a direct dependency bump.

chore(deps): refresh lockfile

Re-resolves every transitive dependency within the existing package.json ranges. package.json is untouched — no direct dependency range churn.

package	before → after	advisories
brace-expansion	1.1.15 → 1.1.18, 5.0.6 → 5.0.9	3 high
js-yaml	4.1.1 → dropped from the tree	2 high, 1 moderate
fast-uri	3.1.2 → 3.1.6	2 high
undici	6.25.0 → 6.28.0	3 moderate, 2 low
vite	8.0.13 → 8.2.2	1 high, 1 moderate

In pnpm-workspace.yaml, the existing brace-expansion and undici override floors move up to the newly patched versions, and a vite override is added — vitest accepts vite@^6 || ^7 || ^8, so a plain resolve happily sits on a vulnerable 8.0.x indefinitely.

fix: keep Migration notes under the breaking changes heading

The refresh pulls conventional-changelog-conventionalcommits 10.2.1 → 10.4.0. That preset used to force every commit note's title to BREAKING CHANGES before rendering; since v10.3 it preserves each note's own title and the writer emits one heading per distinct title.

The practical effect: release-please's synthesized Migration note (the # Migration section lifted out of a breaking change's body in src/commit.ts) would render as a stray ### MIGRATION section instead of a bullet under ### ⚠ BREAKING CHANGES. A snapshot test caught it.

src/changelog-notes/default.ts now retitles the note to BREAKING CHANGE when handing it to the writer, so rendered changelogs are unchanged across the preset upgrade. The parsed ConventionalCommit still carries the Migration title.

This commit is a no-op against the old dependency versions (verified — the old preset retitled the note anyway), so both commits are green independently and the history stays bisectable.

Verification

On Node 24.15.0, all clean:

• pnpm install --frozen-lockfile
• pnpm audit — no known vulnerabilities
• pnpm peers check — no issues
• pnpm lint, pnpm typecheck
• pnpm test — 1010 passed, no snapshot updates
• pnpm build, pnpm build:action

Effect on the open Dependabot PRs

• chore(deps-dev): bump vitest from 4.1.9 to 4.1.10 #86 (vitest 4.1.10) and chore(deps-dev): bump msw from 2.14.6 to 2.14.7 #82 (msw 2.14.7) are superseded — the lockfile now carries vitest 4.1.11 and msw 2.15.0. These should auto-close once this merges.
• chore(deps): bump yargs from 17.7.2 to 18.0.0 #88 (yargs 18) and chore(deps): bump conventional-commits-filter from 3.0.0 to 6.0.1 #85 (conventional-commits-filter 6) are both ESM-only majors. This package compiles to CommonJS and is ncc-bundled, and src/commit.ts pulls in conventional-commits-filter via require. Real work, unrelated to security — not attempted here.
• chore(deps-dev): bump @vercel/ncc from 0.38.4 to 0.44.1 #81 (@vercel/ncc 0.44.1) needs a package.json bump, since ^0.38.4 won't cross a 0.x minor. Not security-related — not attempted here.

🤖 Generated with Claude Code