chore: restore missing security resolutions + close esbuild/uuid alerts

[STRML]

Two things:

1. Repairs chore: clear dependabot security alerts #821. That PR's package.json hunk lost the js-yaml/fast-uri resolutions to a bad working-tree state before commit; only the yarn.lock pins landed, so a fresh yarn install --regenerate-lockfile would regress to vulnerable js-yaml 4.3.0 / fast-uri 3.1.4. This restores them as source-of-truth resolutions.
2. Closes the two new alerts filed after chore: clear dependabot security alerts #821: esbuild (via tsup, No way to account for drag values on scaled elements #139) → ^0.28.2 and uuid (via webpack-dev-server → sockjs, unmount during drag causes invariant throw #130) → ^11.1.1.

All dev-only. tsup builds clean on esbuild 0.28.2 and sockjs's require('uuid').v4 is compatible with uuid 11.

Verified: make build contract OK, make lint clean, 204/204 tests, node_modules resolves to js-yaml 4.3.2 / fast-uri 3.1.8 / esbuild 0.28.2 / uuid 11.1.1.

Summary by CodeRabbit

• Chores
  • Updated package configuration to maintain consistent versions for supporting components.
  • No user-facing functionality or behavior changes are included in this release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a78691f9-ffac-43a7-8e13-368bd9d2a429

📥 Commits

Reviewing files that changed from the base of the PR and between a995fb5 and 669846c.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The package resolutions add four transitive-dependency version overrides. The existing minimist pin remains. The closing brace receives a whitespace-only change.

Changes

Dependency Resolution

Layer / File(s)	Summary
Resolution overrides package.json	The resolutions block adds js-yaml ^4.3.2, fast-uri ^3.1.6, esbuild ^0.28.2, and uuid ^11.1.1. The existing minimist ^1.2.5 pin remains. The closing brace has a whitespace-only change.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: binhpv

Merge Risk: ⚪ Minimal · up to 66984

The dependency updates address the reported vulnerable transitive versions without an identified functional regression, so the change is mergeable.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main changes: restoring missing security resolutions and addressing the esbuild and uuid alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/missing-resolutions

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

package.json

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}