chore(deps): update dev dependencies to latest and fix security advisories

[vanilla-wave]

Summary

Brings the dev toolchain up to date and clears all 4 advisories reported by npm audit (1 critical, 2 high, 1 low). Every vulnerable package is a dev / transitive dependency — the published bundle is unaffected. The only runtime change is a dayjs patch bump (1.11.13 → 1.11.21).

Instead of pinning transitives with overrides, the owning dev dependencies are updated to fresh versions so the patched transitives resolve naturally. A single narrow override remains for the one case that no dependency update can fix (see below).

Vulnerabilities fixed

Package	→	Severity	Advisory	Fixed by
shell-quote	1.7.3 → 1.10.0	Critical	GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv	lockfile refresh (within npm-run-all's range)
brace-expansion	2.1.1 → 2.1.2	High	GHSA-3jxr-9vmj-r5cp	lockfile refresh (existing override range)
js-yaml	3.14.2 / 4.1.1 → 4.3.0	High	GHSA-h67p-54hq-rp68, GHSA-52cp-r559-cp3m	eslint/cosmiconfig resolve 4.3.0; override for the 3.x leaf
@babel/core	7.26.10 → 7.29.7	Low	GHSA-4x5r-pxfx-6jf8	pulled in by jest / @gravity-ui/eslint-config

Notable dev-dependency updates

• jest 29 → 30, @types/jest 29 → 30, jest-environment-jsdom → 30.4.1, ts-jest → 29.4.11 (supports jest 30)
• @commitlint/cli & config-conventional 19 → 20
• size-limit + presets 11 → 12
• @testing-library/jest-dom 6.6 → 6.9, @testing-library/react → 16.3.2, prettier 3.5 → 3.9, @gravity-ui/prettier-config → 1.1.1

The one remaining override

@istanbuljs/load-nyc-config (latest 1.1.0, reached via babel-plugin-istanbul) hard-pins js-yaml@^3.13.1, and no patched 3.x exists — even the latest babel-plugin-istanbul@8 still depends on load-nyc-config@^1.0.0. So no dependency bump can fix it. A scoped override forces it to js-yaml@^4.3.0; that consumer only calls yaml.load(), which exists in 4.x, so it's safe:

"overrides": {
  "@istanbuljs/load-nyc-config": { "js-yaml": "^4.3.0" }
}

Deliberately not bumped (would break support)

• eslint kept on 8 — v9/v10 require migrating .eslintrc → flat config (eslint.config.js) and @gravity-ui/eslint-config v4; out of scope for a security update.
• @commitlint capped at 20, jest-dom at 6 — v21 / v7 require Node ≥ 22, but the repo targets Node 20 (.nvmrc, CI). The chosen versions are the freshest that keep Node 20 support.
• react / react-dom / @types/react* kept at 18 — bumping the peer range to 19 would be a breaking change for consumers.

Other

• src/types.ts — one formatting-only change (prettier 3.9 collapses short union types onto a single line); no behavior change.

Verification (Node 20 target, ran on Node 24)

• npm audit → 0 vulnerabilities
• npm run typecheck ✓
• npm run lint ✓
• npm run build ✓
• jest → 537 passed, 36 suites ✓
• size-limit ✓ (within limits)

🤖 Generated with Claude Code