[TylerVigario]

Updates all 28 dev dependencies to their latest release. This supersedes #459.

• Majors: eslint-plugin-ava 17 → 18 and eslint-plugin-jsdoc 64 → 65. Neither needs a config change. jsdoc 65's one breaking change, to check-indentation, flags nothing here.
• Lockfile refresh: smol-toml moves to 1.9.1, which clears GHSA-r4xh-jqrq-34v2.
• allowScripts: npm 11.16 added this field. It only warns today, and npm says a future release will block install scripts that aren't listed. The one dependency with an install script is unrs-resolver (via eslint-plugin-import-x), so it's denied: its postinstall only downloads the native binding when npm hasn't installed it, and npm installs it as an optional dependency. npm ci no longer warns.
• Engines: the updated tools' engine ranges are the same as on main, and the latest Node 22, 24 and 26 releases satisfy all of them.
• GitHub Actions: every action is already on its latest major, and so is actionlint (1.7.12).

The built dist/ is byte-identical to the published 6.3.0 (all 354 files, diffed against the npm tarball). npm run lint, typecheck and npm test pass.

The security audit

• markdown-it: two high advisories published on 2026-10-20, GHSA-gfr2-rv44-r23c and GHSA-r7fv-28h4-cvq7 (both quadratic-time parsing), cover markdown-it 15.0.1. markdownlint-cli2 0.23.3, its latest release, pins that version exactly. 15.0.3 fixes both, so an override forces it, the same way smol-toml already is, and markdownlint runs clean with it.
• braces: GHSA-vfj7-8cjw-p6xm, a stack-exhaustion DoS from deeply nested patterns, covers braces <= 3.0.3. 3.0.3 is the latest release and the latest ava and markdownlint-cli2 still depend on it, so no update can clear it. It doesn't apply to n2words:
  • The package ships no dependencies: package.json declares none and npm pack has nothing under node_modules, so users never install braces. npm audit --omit=dev finds nothing.
  • In development, braces only parses patterns from this repo: ava's files globs, markdownlint-cli2's config globs, and the staged file paths lint-staged passes to it.
  • Dependabot already auto-dismissed its alert here, as a development-scoped dependency.
• audit-ci: npm audit has no way to set one advisory aside (npm/cli#8886 is still open), so the Security audit step now runs audit-ci. It keeps the same high-severity threshold and reads the one exception, with its reason and an expiry of 2027-01-20, from audit-ci.jsonc. Once that date passes, the advisory fails the gate again. It runs through npx before npm ci, as audit-ci recommends, so no install script runs ahead of the audit. audit-ci is pinned at 7.1.0, but its own dependencies resolve fresh on each run. The contributor checklist in SECURITY.md now points at this gate instead of plain npm audit.

Checked against this lockfile: with braces set aside and markdown-it still at 15.0.1, the gate fails on the two markdown-it advisories. With 15.0.3 it passes, and with the expiry moved to yesterday it fails on braces again.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NfrA9rAkb8oHNcNHDaPVC4