🤖🔵 fix: Resolve open Dependabot vulnerabilities for tar and lodash

[dmattia]

Summary

• Remove @yarnpkg/pnpify and @yarnpkg/sdks dev dependencies — eliminates the @yarnpkg/core → tar@^6 transitive dependency chain. Yarn Berry's PnP runtime handles tool resolution natively, making the pnpify wrapper unnecessary. The sdks command is still available via yarn dlx @yarnpkg/sdks when needed.
• Upgrade mocha from v10 to v11 — moves to chokidar v4 which dropped fsevents, eliminating the fsevents → node-gyp → tar@^6 chain.
• Update lodash from 4.17.21 to 4.17.23 in the lockfile (patched version within existing semver range).

Net result: 118 transitive packages removed, tar eliminated from the dependency tree entirely.

Vulnerabilities Fixed

Alert	Severity	Package	CVE	Resolution
#58	High	tar	CVE-2026-26960	Removed from dep tree
#53	High	tar	CVE-2026-24842	Removed from dep tree
#51	High	tar	CVE-2026-23950	Removed from dep tree
#48	High	tar	CVE-2026-23745	Removed from dep tree
#52	Medium	lodash	CVE-2025-13465	Updated to 4.17.23

Changes

package.json

• Removed @yarnpkg/pnpify and @yarnpkg/sdks from devDependencies
• Updated mocha from ^10.2.0 to ^11.0.0
• Updated scripts to run tsc, eslint, mocha directly instead of via yarn pnpify
• Changed update:sdks script to use yarn dlx @yarnpkg/sdks

yarn.lock / .yarn/cache

• 118 packages removed, 10 added
• tar@6.2.1 fully eliminated
• lodash bumped to 4.17.23

Test plan

• yarn install succeeds
• yarn build compiles cleanly
• yarn test — all 11 tests pass
• yarn lint passes
• yarn why tar returns empty (no tar in dependency tree)
• yarn why lodash shows 4.17.23

Made with Cursor