chore(deps): Weekly Dependency + Security Sweep (Wk 3) — enable Dependabot + pnpm audit sweep + docs pass

[PAMulligan]

Weekly Dependency + Security Sweep (Wk 3)

Part of the recurring PMDS repos dependency + security maintenance. For a coding agent to remediate and open a PR.

⚠️ Dependabot is currently INACTIVE for this repo

GitHub reports: "Dependabot alerts are inactive. To receive Dependabot alerts, you must enable Dependency graph in this repository's settings." So there is no alert data to work from yet — the sweep must be driven by a local pnpm audit.

• (Owner action) Enable Dependency graph + Dependabot alerts in Settings → Security. (Repo-settings/permissions change — left to the maintainer, not the coding agent.)

Workflow (per repo standard)

• Run pnpm audit (and pnpm outdated) to enumerate vulnerable + outdated deps
• Bump outdated + vulnerable deps with pnpm (regenerate pnpm-lock.yaml via pnpm — do NOT hand-edit the lockfile)
• Pay special attention to the shared-stack packages flagged in the sibling repos this week: esbuild (→ >=0.28.1), js-yaml (→ >=4.2.0), @babel/core (→ >=7.29.6), and tar (→ >=7.5.16, major bump) — Claudius shares the React + TS + Vite + Cloudflare Workers + Hono stack, so esbuild (via Vite) is especially likely to be present. Remediate the same way (pnpm.overrides where transitive).
• Run the test suite and confirm CI is green
• Honor the minimumReleaseAge guard (do not pull versions newer than the configured cooldown)
• README/docs accuracy pass (see below)
• Open one PR with a Conventional Commits title/message

README / docs accuracy pass

• Verify any counts/claims in the README match the actual repo (embed/script-tag install, widget config options)
• Verify version badges (shields) reflect current versions / build status
• Verify install steps run cleanly on a fresh clone (single script-tag drop-in + pnpm quickstart)

PR

• Conventional Commits, e.g.: chore(deps): audit + bump vulnerable/outdated deps; docs accuracy pass

---

Filed as part of the weekly PMDS repos Dependency + Security Sweep.