chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 5 open Dependabot security alerts by refreshing devDependencies and the lockfile so vulnerable transitive packages resolve to patched versions
• No production code changes; devDependencies, engines field, and package-lock.json only

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#41	js-yaml	high	Bumped to 3.15.1 (transitive, via markdown-toc -> gray-matter)
#40	js-yaml	high	Bumped to 4.3.1 (transitive, via markdown-link-check -> xmlbuilder2)
#33	linkify-it	high	Bumped to 5.0.2 (transitive, via markdownlint-cli -> markdown-it)
#32	js-yaml	high	Bumped to 4.3.1, resolved alongside alert #40
#31	brace-expansion	high	Bumped to 5.0.9 (transitive, via markdownlint-cli -> minimatch)

Also bumped markdownlint-cli devDependency to ^0.49.1 and declared engines.node >=22.22.2 to keep dev tooling versions explicit and in sync with the transitive dependency requirements pulled in by the lockfile refresh.

Verified with npm audit (0 vulnerabilities) and by running make lint / make markdown-toc locally, matching CI.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d3f3ba37-7c65-4d8d-88d6-e00f81742c80

📥 Commits

Reviewing files that changed from the base of the PR and between ec9b0cb and 9eb8188.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The package manifest now requires Node.js >=22.22.2 and uses markdownlint-cli ^0.49.1.

Changes

Maintenance updates

Layer / File(s)	Summary
Runtime and tooling requirements package.json	The Node.js engine requirement is set to >=22.22.2. The markdownlint-cli development dependency is upgraded to ^0.49.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• open-feature/spec#395: This PR also updates the markdownlint-cli dependency in package.json.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the dependency and security-alert updates in the pull request.
Description check	✅ Passed	The description directly explains the resolved Dependabot alerts, dependency updates, Node.js requirement, and verification steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates JavaScript devDependencies/lockfile to address open Dependabot security alerts affecting transitive packages used by the markdown linting/tooling workflow.

Changes:

• Bumped markdownlint-cli devDependency from ^0.49.0 to ^0.49.1.
• Updated package-lock.json to pull patched transitive versions (including linkify-it, js-yaml, and brace-expansion) and related dependency bumps.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Bumps markdownlint-cli to ^0.49.1 to pick up patched transitive dependencies.
package-lock.json	Refreshes the lockfile with updated transitive dependency versions (including security-related updates).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.markdown-link-check-config.json:11

• This unrelated exemption changes markdown-link-check behavior by permanently skipping the existing CNCF invite link in specification/appendix-c/index.md:19, although the PR is described as a dependency-only security update whose checks behave identically to main. Please remove it from this PR, or separately document why this URL must no longer be validated.

    {
      "pattern": ".*communityinviter.com/apps/cloud-native/cncf.*"

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

package.json:5

• This range is broader than the tooling actually supports. In particular, it accepts Node 23, Node 25, and Node 24.0–24.14, while the newly locked ini@7.0.0 declares ^22.22.2 || ^24.15.0 || >=26.0.0 (package-lock.json:841). Those versions will therefore satisfy the repository contract but trigger an engine mismatch during npm ci (or fail with engine-strict). Match the root range to the tightest transitive requirement.

    "node": ">=22.22.2"