Refresh the conformance runner lockfiles past their advisories
Clears all 18 open Dependabot alerts on this repo. Every one sits in a conformance-runner lockfile — conformance/runner/typescript/package-lock.json and conformance/runner/ruby/Gemfile.lock — and none reaches an SDK: the runners are templates that build inside a consuming repo (README), and this repo has no CI that runs them.
TypeScript (vitest 4.0.18 → 4.1.11, vite 7.3.1 → 8.2.2, postcss → 8.5.28, nanoid → 3.3.18, picomatch → 4.0.7; esbuild drops out of the tree with vite 8):
- #25 @vitest/mocker GHSA-82fw-gwwq-j7x9
- #24 nanoid GHSA-xwg4-73v4-xw9w
- #22, #19, #18 postcss
- #14, #13, #6, #5, #4 vite
- #11 esbuild
- #10 vitest GHSA-5xrq-8626-4rwp
- #3 picomatch
Ruby (json 2.18.1 → 3.0.2, faraday 2.14.1 → 2.14.3, addressable 2.8.9 → 2.9.0):
Lockfile-only; package.json and Gemfile are unchanged and their ranges already admit these versions. The lockfiles were regenerated with npm update --package-lock-only and bundle lock --update, against a stub of the ../../../typescript / ../../../ruby SDK package each one links to (this repo carries neither), so the link entries are unchanged. Runners were not executed here — they cannot be, standalone — but the same bumps run green in fizzy-sdk's runners (vitest 4.1.11, json 3.0.2), which is the closest live consumer.