chore(deps): security audit fix (0 → 0 advisories)

[base44-github-actions]

Automated dependency security fix

Advisories: 0 → 0 (audit run with --min-release-age=7).

The repo had no open advisories before this run and has none after. The only
change is a package-lock.json normalization (net −30 lines) produced when the
engine reinstalled the dependency tree during the audit. No production or dev
dependency version that ships or builds was altered in a way that changes resolved
versions meaningfully — this is lockfile hygiene, not a vulnerability remediation.

Role: library. This is a published SDK. Production deps reach consumers;
devDeps (vitest, eslint, typedoc, etc.) never ship, and a library lockfile does
not propagate downstream to consumers.

Consumer-facing fixes (production deps)

none — no advisories to fix

Dev-only tooling fixes

none — no advisories to fix

Exception bumps (reviewed cooldown overrides)

none

⚠️ Needs a human decision (not auto-fixed)

none

These items — when present — are also tracked in the standing issue
🔒 Dependency advisories needing manual action (maintained automatically by a
separate step) so they don't get lost if this PR merges. There are none this run.
As always, do not run npm audit fix --force on this repo — neverAutoFix
packages (react-quill, quill) would be downgraded to broken releases.

Cooldown integrity

All changes respect the 7-day cooldown (--min-release-age=7). No cooldown
violations were reported and no exception bumps were needed.

Verification

• build: pass
• test: pass

✅ Build and test pass, cooldown respected, and no advisories outstanding. Safe to
merge as routine lockfile maintenance.

🤖 Opened by dependency-security-bot

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.35-pr.213.b3debb7

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.35-pr.213.b3debb7"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.35-pr.213.b3debb7"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.35-pr.213.b3debb7
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}

[yurynix]

Auto-closing: this PR fixed 0 advisories (incidental lockfile churn only). The bot's PR-gate is being fixed to only open PRs when advisories actually decrease.