fix(deps): resolve Dependabot vulnerabilities

[henningmu]

Summary

• Update root and website dependency stacks to patched/current versions where compatible.
• Pin installable dependency versions in both package.json files.
• Replace ad hoc gray-matter patching with patch-package for the forced js-yaml@4.2.0 override.
• Keep undici on 7.x via Renovate until the SDK is ready to raise its runtime Node floor for undici@8.

Residual advisory

This does not close Dependabot alerts 48, 49, or 50. Those are for undici@6.26.0 bundled inside npm@11.17.0, pulled by @semantic-release/npm. npm audit fix --dry-run confirms that bundled copy cannot be fixed until npm publishes a patched package.

Verification

• npm run integrity-checks
• cd website && npm ci
• cd website && npm run typecheck && npm run build
• cd website && npm audit --audit-level=low

Superseded open PRs

This PR includes the patched dependency versions from these currently open Dependabot PRs, so they can be closed after this merges:

• Supersedes build(deps): bump undici from 7.28.0 to 8.5.0 #37 - build(deps): bump undici from 7.24.8 to 7.28.0
• Supersedes build(deps): bump launch-editor from 2.9.1 to 2.14.1 in /website #35 - build(deps): bump launch-editor from 2.9.1 to 2.14.1 in /website
• Supersedes build(deps-dev): bump vite from 7.3.3 to 7.3.5 #34 - build(deps-dev): bump vite from 7.3.3 to 7.3.5
• Supersedes build(deps): bump webpack-dev-server from 5.2.2 to 5.2.5 in /website #33 - build(deps): bump webpack-dev-server from 5.2.2 to 5.2.5 in /website
• Supersedes build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 #32 - build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0
• Supersedes build(deps): bump tar and npm #31 - build(deps): bump tar and npm
• Supersedes build(deps): bump ws in /website #30 - build(deps): bump ws in /website
• Supersedes build(deps): bump markdown-it from 14.1.0 to 14.2.0 in /website #28 - build(deps): bump markdown-it from 14.1.0 to 14.2.0 in /website
• Supersedes build(deps): bump esbuild and vitest #25 - build(deps): bump esbuild and vitest
• Supersedes build(deps-dev): bump shell-quote from 1.8.3 to 1.8.4 #22 - build(deps-dev): bump shell-quote from 1.8.3 to 1.8.4
• Supersedes build(deps): bump shell-quote from 1.8.2 to 1.8.4 in /website #21 - build(deps): bump shell-quote from 1.8.2 to 1.8.4 in /website
• Supersedes build(deps): bump qs and express in /website #14 - build(deps): bump qs and express in /website

Dependabot alerts closed

Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/46
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/45
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/44
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/43
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/42
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/41
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/40
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/39
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/38
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/37
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/35
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/34
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/33
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/32
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/31
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/30
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/29
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/28
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/27
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/26
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/25
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/24
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/23
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/21
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/20
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/18
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/17
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/16
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/12
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/11
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/10
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/9
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/8
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/5
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/3
Closes https://github.com/Doist/comms-sdk-typescript/security/dependabot/2

[doist-release-bot]

🎉 This PR is included in version 0.6.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀